Salon Booking System Appointment Booking For Salons Barbershops Spas
Monthly
Stored cross-site scripting in the Salon Booking System WordPress plugin (Appointment Booking for Salons, Barbershops & Spas, all versions up to and including 10.31.9) lets unauthenticated attackers inject arbitrary JavaScript through the sln[<checkout-field-key>] checkout parameter, which is persisted and later executed when a user loads the affected page - in practice the admin customer view. Impact is conditional: the site must have at least one admin-configured custom checkout field of type Html or File, a documented but non-default plugin feature, so sites without such a field are not exploitable. No public exploit code has been identified at time of analysis, and the independent assessment rates the issue as a moderate, conditional risk rather than an emergency, downgrading the vendor's AC:L to AC:H because of the configuration dependency and the admin-context trigger.
Stored cross-site scripting in the Salon Booking System WordPress plugin (Appointment Booking for Salons, Barbershops & Spas, all versions up to and including 10.31.9) lets unauthenticated attackers inject arbitrary JavaScript through the sln[<checkout-field-key>] checkout parameter, which is persisted and later executed when a user loads the affected page - in practice the admin customer view. Impact is conditional: the site must have at least one admin-configured custom checkout field of type Html or File, a documented but non-default plugin feature, so sites without such a field are not exploitable. No public exploit code has been identified at time of analysis, and the independent assessment rates the issue as a moderate, conditional risk rather than an emergency, downgrading the vendor's AC:L to AC:H because of the configuration dependency and the admin-context trigger.