{
 "id": "WPSEC-2026-1097",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1097/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1097/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1097/index.md",
 "title": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via SVG Image Upload",
 "description": "The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter of the service and assistant REST API endpoints in all versions up to, and including, 10.31.10. This is due to the remote file being written directly to the uploads folder with SVG allowed, based only on the extension in the URL and with no check that the content is a real image. This makes it possible for authenticated attackers with access to the plugin's services or assistants, such as the Salon Staff role, who lack the unfiltered_html capability, to upload SVG files containing arbitrary web scripts that execute whenever a user opens the file.",
 "plugin": {
  "slug": "salon-booking-system",
  "name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "full_name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "wordpress_org": "https://wordpress.org/plugins/salon-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/salon-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/salon-booking-system"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "10.31.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 10.31.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "10.31.11",
 "remediation": "Update to 10.31.11 or later.",
 "fix_released": "2026-10-15T09:09:44+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T11:27:45.241656+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1097/",
  "https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/",
  "https://wordpress.org/plugins/salon-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/salon-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}