CVE-2026-5513: Bookly Unauthenticated Stored XSS via Cookie (CVSS 7.2)

CVE-2026-5513: a CVSS 7.2 unauthenticated stored XSS in the Bookly WordPress plugin. The bookly-customer-full-name cookie renders unescaped on the booking form.