Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via SVG Image Upload
- ID
- WPSEC-2026-1097
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.11
- Remediation
- Update to 10.31.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter of the service and assistant REST API endpoints in all versions up to, and including, 10.31.10. This is due to the remote file being written directly to the uploads folder with SVG allowed, based only on the extension in the URL and with no check that the content is a real image. This makes it possible for authenticated attackers with access to the plugin's services or assistants, such as the Salon Staff role, who lack the unfiltered_html capability, to upload SVG files containing arbitrary web scripts that execute whenever a user opens the file.
References
- https://wpsec.com/vuln/WPSEC-2026-1097/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS