# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Fields

- **ID:** WPSEC-2026-0853
- **Plugin:** Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (`salon-booking-system`), https://wordpress.org/plugins/salon-booking-system/
- **Affected versions:** all versions before 10.31.10
- **Fixed in:** 10.31.10 (Update to 10.31.10 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/salon-booking-system
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0853/

## Description

The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom checkout fields in all versions up to, and including, 10.31.9, due to insufficient input sanitization when customer field values submitted in the booking form are saved as user meta (during registration at checkout and during logged-in checkout), and insufficient output escaping when file-type field names and html-type field values are displayed in the admin customer view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator or staff member views the affected customer's profile. Exploitation requires a file-type or html-type custom checkout field that is shown in the customer profile.

## References

- https://wpsec.com/vuln/WPSEC-2026-0853/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.10/
- https://wordpress.org/plugins/salon-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0853/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.