Salon Booking System EUVD-2026-95622

Exploitation requires a victim to load an attacker-crafted request/URL against the Salon Booking System plugin (UI:R), so it cannot be triggered silently or server-to-server; it relies on social engineering such as a phishing link. Per PR:N the attacker needs no authentication, but the specific vulnerable parameter/endpoint that reflects input is not named in the description. The plugin must be installed and active on a WordPress site, and the affected version must be n/a through 10.31.5. The limiting factors are the mandatory user interaction and the browser-scoped (not server-scoped) impact, which meaningfully reduce real-world blast radius compared to the raw 7.1 score.

This is a reflected cross-site scripting (CWE-79) flaw in the Salon Booking System WordPress plugin, rated CVSS 7.1 (High) by Patchstack with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The CVSS signals are internally consistent for reflected XSS: network attack vector, low complexity, no privileges required, but mandatory user interaction (UI:R) - the victim must click or load an attacker-crafted request. The scope change (S:C) and the three Low impact ratings reflect that injected script executes in the victim's browser session rather than compromising the server directly. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied; the single reference is the Patchstack advisory. Exploitation status is therefore: no public exploit identified at time of analysis. The practical risk is moderate and bounded - reflected XSS is not server-side RCE and depends on tricking an authenticated or unauthenticated user into following a malicious link, so this is a 'real but not drop-everything' priority. The absence of EPSS/KEV means widespread automated exploitation cannot be confirmed; treat the 7.1 as a severity ceiling, not evidence of active attack.

An attacker crafts a URL for a vulnerable Salon Booking System endpoint that reflects attacker-controlled input unescaped into the page, then delivers it to a victim (e.g., a site admin or booking user) via phishing or a malicious link. When the victim loads the link, the injected JavaScript runs in their browser under the site's origin, enabling session/cookie theft, booking-form manipulation, or actions on the victim's behalf. No public POC was referenced, and successful exploitation requires the victim to interact with the crafted link (UI:R).