Salon Booking System Vulnerabilities

The Salon Booking System plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.30.19. This is due to missing capability check and nonce verification on the SetBookingStatus and SetDefaultBookingStatus AJAX handlers. This makes it possible for authenticated attackers, with subs...

CVSS:

4.3

Affected:

up to 10.30.19

Fixed in:

10.30.20

Disclosed:

Aug 10, 2026

CVE-2026-11887 on NVD →

The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 10.30.26. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 10.30.26

Fixed in:

10.30.27

Disclosed:

Aug 7, 2026

CVE-2026-66453 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 10.30.33. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 10.30.33

Fixed in:

10.30.34

Disclosed:

Aug 6, 2026

CVE-2026-17022 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 10.30.33. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 10.30.33

Fixed in:

10.30.34

Disclosed:

Aug 6, 2026

CVE-2026-17021 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 10.30.33. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 10.30.33

Fix:

No patched version reported

Disclosed:

Aug 6, 2026

CVE-2026-17023 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 10.31.0. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an...

CVSS:

4.3

Affected:

up to 10.31.0

Fix:

No patched version reported

Disclosed:

Aug 6, 2026

CVE-2026-17020 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inject arbitrary PHP code i...

CVSS:

8.8

Affected:

up to 10.30.32

Fixed in:

10.30.33

Disclosed:

Jul 9, 2026

CVE-2026-15070 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 10.30.25. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 10.30.25

Fixed in:

10.30.26

Disclosed:

May 10, 2026

CVE-2026-42666 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it p...

CVSS:

7.5

Affected:

up to 10.30.25

Fixed in:

10.30.26

Disclosed:

May 1, 2026

CVE-2026-6320 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.30.24 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform unauthorized actions.

CVSS:

5.3

Affected:

up to 10.30.24

Fixed in:

10.30.25

Disclosed:

Apr 21, 2026

CVE-2026-40768 on NVD →

[en] Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.

Affected:

up to 10.30.3

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2025-67954 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.30.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

CVSS:

3.1

Affected:

up to 10.30.3

Fixed in:

10.30.4

Disclosed:

Jan 21, 2026

CVE-2025-67954 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.30.3.

Affected:

up to 10.30.3

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-66531 on NVD →

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they...

CVSS:

4.3

Affected:

up to 10.30.3

Fixed in:

10.30.4

Disclosed:

Dec 7, 2025

CVE-2025-66531 on NVD →

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticated attackers to execute...

CVSS:

5.3

Affected:

up to 10.22

Fixed in:

10.24

Disclosed:

Sep 10, 2025

CVE-2025-8492 on NVD →

[en] Unauthenticated Cross Site Request Forgery (CSRF) in Salon booking system <= 10.16 versions.

Affected:

up to 10.16

Fix:

No patched version reported

Disclosed:

May 19, 2025

CVE-2025-47583 on NVD →

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.16. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to d...

CVSS:

4.3

Affected:

up to 10.16

Fixed in:

10.17

Disclosed:

May 15, 2025

CVE-2025-47583 on NVD →

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 10.29.6. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVSS:

4.3

Affected:

up to 10.29.6

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32220 on NVD →

[en] Missing Authorization vulnerability in Dimitri Grassi Salon booking system allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Salon booking system: from n/a through 10.10.7.

Affected:

up to 10.16

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32220 on NVD →

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.11. This makes it possible for authenticated attackers, with Custom-level access and above, to elevate their privileges.

CVSS:

8.8

Affected:

up to 10.11

Fixed in:

10.15

Disclosed:

Apr 1, 2025

CVE-2025-31560 on NVD →

[en] Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system allows Privilege Escalation. This issue affects Salon booking system: from n/a through 10.11.

Affected:

up to 10.15

Fixed in:

10.15

Disclosed:

Apr 1, 2025

CVE-2025-31560 on NVD →

[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....

Affected:

up to 7.6.3

Fixed in:

7.6.3

Disclosed:

Oct 16, 2024

CVE-2022-4974 on NVD →

[en] Authorization Bypass Through User-Controlled Key vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.9.

Affected:

up to 10.9.1

Fixed in:

10.9.1

Disclosed:

Oct 5, 2024

CVE-2024-47316 on NVD →

The Salon Booking System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.9 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 10.9

Fixed in:

10.9.1

Disclosed:

Sep 25, 2024

CVE-2024-47316 on NVD →

The Salon Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in...

CVSS:

4.4

Affected:

up to 10.9.3

Fixed in:

10.9.4

Disclosed:

Sep 13, 2024

CVE-2024-9882 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.This issue affects Salon booking system: from n/a through 10.7.

Affected:

up to 10.8

Fixed in:

10.8

Disclosed:

Aug 29, 2024

CVE-2024-39658 on NVD →

[en] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.8.1.

Affected:

up to 10.9

Fixed in:

10.9

Disclosed:

Aug 19, 2024

CVE-2024-43280 on NVD →

The Salon Booking System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 10.8.1. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully t...

CVSS:

6.1

Affected:

up to 10.8.1

Fixed in:

10.9

Disclosed:

Aug 16, 2024

CVE-2024-43280 on NVD →

The Salon booking system plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in versions up to, and including, 10.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit...

CVSS:

9.1

Affected:

up to 10.7

Fixed in:

10.8

Disclosed:

Aug 1, 2024

CVE-2024-39658 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.This issue affects Salon booking system: from n/a through 9.9.

Affected:

up to 10.0

Fixed in:

10.0

Disclosed:

Jun 24, 2024

CVE-2024-37231 on NVD →

[en] The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to uplo...

Affected:

up to 10.3

Fixed in:

10.3

Disclosed:

Jun 19, 2024

CVE-2024-3229 on NVD →

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload ar...

CVSS:

9.8

Affected:

up to 10.2

Fixed in:

10.3

Disclosed:

Jun 18, 2024

CVE-2024-3229 on NVD →

[en] The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to...

Affected:

up to 10.0

Fixed in:

10.0

Disclosed:

Jun 8, 2024

CVE-2024-4468 on NVD →

The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modi...

CVSS:

4.3

Affected:

up to 9.9

Fixed in:

10.0

Disclosed:

Jun 7, 2024

CVE-2024-4468 on NVD →

[en] The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, incl...

Affected:

up to 9.9

Fixed in:

9.9

Disclosed:

May 21, 2024

CVE-2024-4442 on NVD →

The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including...

CVSS:

9.1

Affected:

up to 9.9

Fixed in:

10.0

Disclosed:

May 17, 2024

CVE-2024-4442 on NVD →

[en] Improper Privilege Management vulnerability in Salon Booking System Salon booking system allows Privilege Escalation.This issue affects Salon booking system: from n/a through 8.6.

Affected:

up to 8.7

Fixed in:

8.7

Disclosed:

May 17, 2024

CVE-2023-48319 on NVD →

The Salon booking system plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.5. This is due to missing or incorrect nonce validation on the salon-settings page. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged reques...

CVSS:

4.3

Affected:

up to 9.6.5

Fixed in:

9.6.6

Disclosed:

Apr 26, 2024

CVE-2024-2429 on NVD →

[en] The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affected:

up to 9.6.6

Fixed in:

9.6.6

Disclosed:

Apr 26, 2024

CVE-2024-2429 on NVD →

[en] The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 9.6.6

Fixed in:

9.6.6

Disclosed:

Apr 26, 2024

CVE-2024-2439 on NVD →

[en] The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unf...

Affected:

up to 9.6.6

Fixed in:

9.6.6

Disclosed:

Apr 26, 2024

CVE-2024-2603 on NVD →

[en] The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Customers' page and the malicious script is exec...

Affected:

up to 9.6.3

Fixed in:

9.6.3

Disclosed:

Apr 17, 2024

CVE-2024-2101 on NVD →

[en] The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and th...

Affected:

up to 9.6.3

Fixed in:

9.6.3

Disclosed:

Apr 17, 2024

CVE-2024-2102 on NVD →

The Salon booking system plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 9.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary...

CVSS:

4.4

Affected:

up to 9.6.5

Fixed in:

9.6.6

Disclosed:

Apr 5, 2024

CVE-2024-2439 on NVD →

The Salon booking system plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email settings in all versions up to, and including, 9.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arb...

CVSS:

4.4

Affected:

up to 9.6.5

Fixed in:

9.6.6

Disclosed:

Apr 5, 2024

CVE-2024-2603 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5.

Affected:

up to 9.5.1

Fixed in:

9.5.1

Disclosed:

Mar 29, 2024

CVE-2024-30510 on NVD →

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_item_image() function in all versions up to, and including, 9.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may ma...

CVSS:

10

Affected:

up to 9.5

Fixed in:

9.5.1

Disclosed:

Mar 28, 2024

CVE-2024-30510 on NVD →

The Salon booking system plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sms_prefix' parameter in all versions up to, and including, 9.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

7.2

Affected:

up to 9.6.2

Fixed in:

9.6.3

Disclosed:

Mar 27, 2024

CVE-2024-2102 on NVD →

The Salon booking system plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Mobile Phone' parameter in all versions up to, and including, 9.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to...

CVSS:

5.4

Affected:

up to 9.6.2

Fixed in:

9.6.3

Disclosed:

Mar 27, 2024

CVE-2024-2101 on NVD →

The Salon booking system plugin for WordPress is vulnerable to privilege escalation in all versions up to, but excluding, 8.7. This makes it possible for authenticated attackers, with editor-level access and above, to escalate their privileges to that of an administrator.

CVSS:

7.2

Affected:

up to 8.7

Fixed in:

8.7

Disclosed:

Nov 23, 2023

CVE-2023-48319 on NVD →

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 8.4.8

Fixed in:

8.4.9

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →

[en] The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated attackers to change the admin role to customer or chang...

Affected:

up to 8.4.8

Fixed in:

8.4.8

Disclosed:

Jun 28, 2023

CVE-2023-3427 on NVD →

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated attackers to change the admin role to customer or change the...

CVSS:

5.4

Affected:

up to 8.4.7

Fixed in:

8.4.8

Disclosed:

Jun 27, 2023

CVE-2023-3427 on NVD →

[en] Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script.

Affected:

up to 7.9.4

Fixed in:

7.9.4

Disclosed:

Dec 5, 2022

CVE-2022-43487 on NVD →

The Salon booking system plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu...

CVSS:

6.1

Affected:

up to 7.9

Fixed in:

7.9.4

Disclosed:

Nov 8, 2022

CVE-2022-43487 on NVD →

WordPress Plugin "Salon booking system" contains a cross-site scripting vulnerability (CWE-79). Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Solution: [Update the plugin] Update the...

Affected:

up to 7.9

Fixed in:

7.9

Disclosed:

Nov 8, 2022

[en] The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data

Affected:

up to 7.6.3

Fixed in:

7.6.3

Disclosed:

Apr 11, 2022

CVE-2022-0920 on NVD →

[en] The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who...

Affected:

up to 7.6.3

Fixed in:

7.6.3

Disclosed:

Apr 11, 2022

CVE-2022-0919 on NVD →

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data

CVSS:

7.5

Affected:

up to 7.6.2

Fixed in:

7.6.3

Disclosed:

Mar 21, 2022

CVE-2022-0920 on NVD →

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booke...

CVSS:

5.3

Affected:

up to 7.6.2

Fixed in:

7.6.3

Disclosed:

Mar 21, 2022

CVE-2022-0919 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 7.6.3

Fixed in:

7.6.3

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

Affected:

up to 7.6.3

Fixed in:

7.6.3

Disclosed:

Mar 4, 2022

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Salon booking system plugin (versions <= 7.6.1).

Affected:

up to 7.6.3

Fixed in:

7.6.3

Disclosed:

Feb 28, 2022

[en] The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered...

Affected:

up to 6.3.1

Fixed in:

6.3.1

Disclosed:

Jul 12, 2021

CVE-2021-24429 on NVD →

The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when...

CVSS:

6.1

Affected:

up to 6.3.1

Fixed in:

6.3.1

Disclosed:

Jun 21, 2021

CVE-2021-24429 on NVD →

Affected:

up to 10.9.4

Fixed in:

10.9.4

CVE-2024-9882 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 8.4.9

Fixed in:

8.4.9

CVE-2023-33999 on NVD →