Salon Booking System
Monthly
Cross-site request forgery in the Salon Booking System WordPress plugin (versions before 10.31.9) allows unauthenticated attackers to forge REST API requests in a logged-in administrator's browser by tricking the victim into clicking a crafted link, potentially leading to full site takeover via creation of a new administrator account. The flaw (CWE-352) stems from the plugin discarding WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version installed. Publicly available exploit code exists; EPSS is low at 0.11% (1st percentile), and there is no confirmed active exploitation (CISA KEV).
Reflected cross-site scripting in the Salon Booking System WordPress plugin (all versions through 10.31.5) lets remote, unauthenticated attackers inject and execute arbitrary script by luring a victim to a crafted URL or request. Exploitation requires the victim to load the malicious request (UI:R), so it cannot be triggered silently or server-to-server; the resulting script runs in the victim's browser session and can enable cookie/session theft, credential phishing, or actions performed as the victim. Patchstack rates it CVSS 7.1 (High), while the independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the impact is browser-scoped rather than server-scoped; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated privilege escalation in the Salon Booking System WordPress plugin (versions 10.31.7 and earlier) allows remote attackers to elevate privileges by inducing a victim to trigger a crafted request, due to incorrect privilege assignment (CWE-266) in the plugin's role handling. The attack requires user interaction (UI:R) but no authentication (PR:N), and affects any WordPress site with the vulnerable plugin active. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited, yet the high CVSS score (8.8) and potential for significant site compromise warrant prompt remediation.
Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
Unauthenticated Insecure Direct Object Reference in the Salon Booking System WordPress plugin (versions <= 10.30.24) allows remote attackers to access or manipulate booking objects belonging to other users by tampering with object identifiers in requests. The flaw was reported by Patchstack and affects the dimitri_grassi salon_booking_system plugin per the provided CPE, with no public exploit identified at time of analysis.
Unauthenticated information disclosure in the Salon Booking System WordPress plugin (versions up to and including 10.30.25) allows remote attackers to bypass authorization checks and access sensitive data without credentials. The flaw, tracked by Patchstack and tagged as an authentication bypass, is network-reachable with low complexity and no user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized booking creation in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated remote attackers to forge bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment being made. The flaw is a missing authorization check (CWE-862) reachable over the network with no authentication or user interaction required (CVSS 3.1 base 5.3 MEDIUM, integrity-only impact). Publicly available exploit code exists, EPSS is low at 0.15% (3rd percentile), and a vendor patch (10.31.9) is available.
Authentication bypass in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated attackers to compute valid booking-API tokens for staff or administrator accounts, gaining access to the booking API as those users. The tokens are generated from a hardcoded value and the one-second issuance timestamp instead of a secure random source, so an attacker who can constrain that timestamp can forge a token. Publicly available exploit code exists, but EPSS is only 0.14% and the issue is not in CISA KEV, consistent with the high complexity (AC:H) of bounding the issuance window; the vendor has released version 10.31.9 to fix it.
The Salon Booking System WordPress plugin before 10.31.3 fails to enforce capability checks on several of its booking REST API routes, so any authenticated user - including a low-privilege subscriber - can retrieve the booking records and personal data of every customer on the site. The vulnerability is remotely reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3) but requires a valid account, meaning sites that allow self-service registration or that host untrusted low-privilege users are the realistic attack surface. Publicly available exploit code exists via the WPScan disclosure, though EPSS is low (0.15%, 4th percentile) and no active exploitation has been confirmed. This is a genuine but moderate-priority information disclosure issue rather than a top-tier emergency.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
OAuth token hijacking in the Salon Booking System WordPress plugin (through 10.30.33) allows unauthenticated remote attackers to overwrite the site's stored Google Calendar connection credentials with attacker-controlled OAuth tokens, fully hijacking the calendar integration. Exploitation requires the target site to have independently configured a Google OAuth client for the calendar sync feature, limiting the exposed population. No public exploit has reached CISA KEV status, but a publicly available proof-of-concept was published by WPScan, and EPSS remains low at 0.14% (3rd percentile), consistent with a niche plugin requiring a non-default configuration. The primary consequence is persistent integrity and availability disruption of the booking-calendar workflow, with a secondary confidentiality risk if future appointment data is synced to the attacker's Google account.
Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote visitor to tamper with the stored total of arbitrary bookings by invoking unprotected booking-modification AJAX endpoints. The plugin neither restricts access to these actions nor verifies that the requesting user owns the targeted booking, creating a CWE-862 missing-authorization flaw. No public exploitation in CISA KEV has been confirmed, though a publicly available proof-of-concept exists via WPScan, and EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic rather than widespread active exploitation.
Insecure Direct Object Reference (IDOR) in the Salon Booking System WordPress plugin through version 10.30.33 allows any authenticated user - including self-registered subscriber and customer accounts - to enumerate booking identifiers via a REST API endpoint and retrieve personal data belonging to any other customer, including name, email, phone number, physical address, and private appointment notes. The plugin fails to verify that the requested booking belongs to the calling user, requiring only a basic read-level WordPress capability. A publicly available proof-of-concept exists per WPScan disclosure; no active exploitation has been confirmed in CISA KEV at time of analysis.
Missing authorization on an AJAX endpoint in the Salon Booking System WordPress plugin (all versions before 10.30.20) allows any authenticated subscriber-level user to modify plugin settings and disable the manual approval workflow for new bookings. A publicly available proof-of-concept exists per WPScan's disclosure, making exploitation straightforward for any registered user on affected sites. No public exploitation (CISA KEV) has been confirmed, and SSVC assessment classifies technical impact as partial with exploitation not yet automated.
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the WordPress Salon Booking System plugin (versions through 10.10.7) allows authenticated attackers with low-privilege accounts to bypass access controls and perform privileged actions, compromising confidentiality, integrity, and availability. Exploitation is remote with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but requires a valid low-privilege account; sites with open registration are at higher risk. No public exploit code has been identified, and EPSS is 0.25% (percentile 49%), but the CVSS score of 8.8 indicates significant risk if exploited.
Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system allows Privilege Escalation.11. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.7. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.8.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.9. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 33.7%.
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery in the Salon Booking System WordPress plugin (versions before 10.31.9) allows unauthenticated attackers to forge REST API requests in a logged-in administrator's browser by tricking the victim into clicking a crafted link, potentially leading to full site takeover via creation of a new administrator account. The flaw (CWE-352) stems from the plugin discarding WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version installed. Publicly available exploit code exists; EPSS is low at 0.11% (1st percentile), and there is no confirmed active exploitation (CISA KEV).
Reflected cross-site scripting in the Salon Booking System WordPress plugin (all versions through 10.31.5) lets remote, unauthenticated attackers inject and execute arbitrary script by luring a victim to a crafted URL or request. Exploitation requires the victim to load the malicious request (UI:R), so it cannot be triggered silently or server-to-server; the resulting script runs in the victim's browser session and can enable cookie/session theft, credential phishing, or actions performed as the victim. Patchstack rates it CVSS 7.1 (High), while the independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the impact is browser-scoped rather than server-scoped; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated privilege escalation in the Salon Booking System WordPress plugin (versions 10.31.7 and earlier) allows remote attackers to elevate privileges by inducing a victim to trigger a crafted request, due to incorrect privilege assignment (CWE-266) in the plugin's role handling. The attack requires user interaction (UI:R) but no authentication (PR:N), and affects any WordPress site with the vulnerable plugin active. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited, yet the high CVSS score (8.8) and potential for significant site compromise warrant prompt remediation.
Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
Unauthenticated Insecure Direct Object Reference in the Salon Booking System WordPress plugin (versions <= 10.30.24) allows remote attackers to access or manipulate booking objects belonging to other users by tampering with object identifiers in requests. The flaw was reported by Patchstack and affects the dimitri_grassi salon_booking_system plugin per the provided CPE, with no public exploit identified at time of analysis.
Unauthenticated information disclosure in the Salon Booking System WordPress plugin (versions up to and including 10.30.25) allows remote attackers to bypass authorization checks and access sensitive data without credentials. The flaw, tracked by Patchstack and tagged as an authentication bypass, is network-reachable with low complexity and no user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized booking creation in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated remote attackers to forge bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment being made. The flaw is a missing authorization check (CWE-862) reachable over the network with no authentication or user interaction required (CVSS 3.1 base 5.3 MEDIUM, integrity-only impact). Publicly available exploit code exists, EPSS is low at 0.15% (3rd percentile), and a vendor patch (10.31.9) is available.
Authentication bypass in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated attackers to compute valid booking-API tokens for staff or administrator accounts, gaining access to the booking API as those users. The tokens are generated from a hardcoded value and the one-second issuance timestamp instead of a secure random source, so an attacker who can constrain that timestamp can forge a token. Publicly available exploit code exists, but EPSS is only 0.14% and the issue is not in CISA KEV, consistent with the high complexity (AC:H) of bounding the issuance window; the vendor has released version 10.31.9 to fix it.
The Salon Booking System WordPress plugin before 10.31.3 fails to enforce capability checks on several of its booking REST API routes, so any authenticated user - including a low-privilege subscriber - can retrieve the booking records and personal data of every customer on the site. The vulnerability is remotely reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3) but requires a valid account, meaning sites that allow self-service registration or that host untrusted low-privilege users are the realistic attack surface. Publicly available exploit code exists via the WPScan disclosure, though EPSS is low (0.15%, 4th percentile) and no active exploitation has been confirmed. This is a genuine but moderate-priority information disclosure issue rather than a top-tier emergency.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
OAuth token hijacking in the Salon Booking System WordPress plugin (through 10.30.33) allows unauthenticated remote attackers to overwrite the site's stored Google Calendar connection credentials with attacker-controlled OAuth tokens, fully hijacking the calendar integration. Exploitation requires the target site to have independently configured a Google OAuth client for the calendar sync feature, limiting the exposed population. No public exploit has reached CISA KEV status, but a publicly available proof-of-concept was published by WPScan, and EPSS remains low at 0.14% (3rd percentile), consistent with a niche plugin requiring a non-default configuration. The primary consequence is persistent integrity and availability disruption of the booking-calendar workflow, with a secondary confidentiality risk if future appointment data is synced to the attacker's Google account.
Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote visitor to tamper with the stored total of arbitrary bookings by invoking unprotected booking-modification AJAX endpoints. The plugin neither restricts access to these actions nor verifies that the requesting user owns the targeted booking, creating a CWE-862 missing-authorization flaw. No public exploitation in CISA KEV has been confirmed, though a publicly available proof-of-concept exists via WPScan, and EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic rather than widespread active exploitation.
Insecure Direct Object Reference (IDOR) in the Salon Booking System WordPress plugin through version 10.30.33 allows any authenticated user - including self-registered subscriber and customer accounts - to enumerate booking identifiers via a REST API endpoint and retrieve personal data belonging to any other customer, including name, email, phone number, physical address, and private appointment notes. The plugin fails to verify that the requested booking belongs to the calling user, requiring only a basic read-level WordPress capability. A publicly available proof-of-concept exists per WPScan disclosure; no active exploitation has been confirmed in CISA KEV at time of analysis.
Missing authorization on an AJAX endpoint in the Salon Booking System WordPress plugin (all versions before 10.30.20) allows any authenticated subscriber-level user to modify plugin settings and disable the manual approval workflow for new bookings. A publicly available proof-of-concept exists per WPScan's disclosure, making exploitation straightforward for any registered user on affected sites. No public exploitation (CISA KEV) has been confirmed, and SSVC assessment classifies technical impact as partial with exploitation not yet automated.
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the WordPress Salon Booking System plugin (versions through 10.10.7) allows authenticated attackers with low-privilege accounts to bypass access controls and perform privileged actions, compromising confidentiality, integrity, and availability. Exploitation is remote with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but requires a valid low-privilege account; sites with open registration are at higher risk. No public exploit code has been identified, and EPSS is 0.25% (percentile 49%), but the CVSS score of 8.8 indicates significant risk if exploited.
Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system allows Privilege Escalation.11. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.7. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.8.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.9. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 33.7%.
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.