Salon Booking System CVE-2026-109232

Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File - a documented but non-default plugin feature; sites without such a field are not exploitable. No authentication is required to inject the payload (PR:N), but the stored script executes only when a user loads the affected page, and the referenced sink is the admin customer view, so the practical victim is typically an authenticated administrator browsing booking records. This configuration dependency and the admin-context trigger are the primary factors limiting real-world exploitation despite the unauthenticated injection vector.

This is a genuine but conditional, moderate-priority issue rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) signals unauthenticated network-based stored XSS with a scope change, which is why it scores High. However, that score understates one key friction point: the description states exploitation requires the administrator to have configured at least one custom checkout field of type Html or File - a non-default (if documented) condition that the attacker cannot control, which realistically belongs in attack complexity. There is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the supplied data, so this is 'no public exploit identified at time of analysis' and not confirmed active exploitation. Signals are therefore mutually consistent on the low-urgency side: a High CVSS driven by unauthenticated input and scope change, but no exploitation-probability or KEV evidence and a required non-default configuration. Net: a real, patch-worthy stored XSS whose practical blast radius depends on site configuration, best triaged as a routine-to-moderate WordPress plugin update rather than an actively-exploited crisis. Note the UI metric: Wordfence rated UI:N, but the payload executes only when a user (per the admin-view sinks in the references, typically the administrator) loads the affected page - verify whether victim interaction should be modeled.

On a salon site where the administrator has enabled an Html or File custom checkout field, an unauthenticated attacker submits a booking and injects a malicious script through the 'sln[<checkout-field-key>]' parameter, which is stored without sanitization. When an administrator later opens the booking/customer record in wp-admin (the sink shown in the referenced views/admin/_customer.php), the script executes in the admin's authenticated browser context, enabling session hijacking or admin actions. No public exploit code was identified in the provided data.