Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Fields
- ID
- WPSEC-2026-0853
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.10
- Remediation
- Update to 10.31.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom checkout fields in all versions up to, and including, 10.31.9, due to insufficient input sanitization when customer field values submitted in the booking form are saved as user meta (during registration at checkout and during logged-in checkout), and insufficient output escaping when file-type field names and html-type field values are displayed in the admin customer view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator or staff member views the affected customer's profile. Exploitation requires a file-type or html-type custom checkout field that is shown in the customer profile.
References
- https://wpsec.com/vuln/WPSEC-2026-0853/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.10/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS