{
 "id": "WPSEC-2026-0853",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0853/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0853/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0853/index.md",
 "title": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Fields",
 "description": "The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom checkout fields in all versions up to, and including, 10.31.9, due to insufficient input sanitization when customer field values submitted in the booking form are saved as user meta (during registration at checkout and during logged-in checkout), and insufficient output escaping when file-type field names and html-type field values are displayed in the admin customer view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator or staff member views the affected customer's profile. Exploitation requires a file-type or html-type custom checkout field that is shown in the customer profile.",
 "plugin": {
  "slug": "salon-booking-system",
  "name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "full_name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "wordpress_org": "https://wordpress.org/plugins/salon-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/salon-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/salon-booking-system"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "10.31.10",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 10.31.10"
  ]
 },
 "introduced_in": null,
 "fixed_in": "10.31.10",
 "remediation": "Update to 10.31.10 or later.",
 "fix_released": "2026-10-12T18:42:51+00:00",
 "published": "2026-10-13T20:09:59+00:00",
 "updated": "2026-10-13T12:13:11.972739+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0853/",
  "https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.10/",
  "https://wordpress.org/plugins/salon-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/salon-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}