# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Stored Cross-Site Scripting via SVG Image Upload

- **ID:** WPSEC-2026-1097
- **Plugin:** Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (`salon-booking-system`), https://wordpress.org/plugins/salon-booking-system/
- **Affected versions:** all versions before 10.31.11
- **Fixed in:** 10.31.11 (Update to 10.31.11 or later.)
- **Severity:** Medium 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/salon-booking-system
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1097/

## Description

The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter of the service and assistant REST API endpoints in all versions up to, and including, 10.31.10. This is due to the remote file being written directly to the uploads folder with SVG allowed, based only on the extension in the URL and with no check that the content is a real image. This makes it possible for authenticated attackers with access to the plugin's services or assistants, such as the Salon Staff role, who lack the unfiltered_html capability, to upload SVG files containing arbitrary web scripts that execute whenever a user opens the file.

## References

- https://wpsec.com/vuln/WPSEC-2026-1097/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1097/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.