Wordpresschef
Monthly
Stored cross-site scripting in the Salon Booking System WordPress plugin (Appointment Booking for Salons, Barbershops & Spas, all versions up to and including 10.31.9) lets unauthenticated attackers inject arbitrary JavaScript through the sln[<checkout-field-key>] checkout parameter, which is persisted and later executed when a user loads the affected page - in practice the admin customer view. Impact is conditional: the site must have at least one admin-configured custom checkout field of type Html or File, a documented but non-default plugin feature, so sites without such a field are not exploitable. No public exploit code has been identified at time of analysis, and the independent assessment rates the issue as a moderate, conditional risk rather than an emergency, downgrading the vendor's AC:L to AC:H because of the configuration dependency and the admin-context trigger.
Remote code execution in the Salon Booking System - Free Version WordPress plugin (all versions ≤ 10.30.32) lets a remote attacker write attacker-controlled PHP into the plugin's web-accessible translate-constants.php file by abusing the unprotected setCustomText AJAX handler. Because the handler lacks proper nonce validation (CWE-352 CSRF), an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can achieve full server-side code execution. Reported by Wordfence with a CVSS of 8.8; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Arbitrary file read in Salon Booking System plugin for WordPress (versions ≤10.30.25) allows unauthenticated remote attackers to exfiltrate sensitive local files by injecting malicious file paths into booking form fields, which are then attached to confirmation emails sent by the system. Wordfence identified this path traversal vulnerability (CWE-22) with a CVSS score of 7.5, exploitable without authentication or user interaction. The vulnerability is confirmed patched in version 10.30.26 via changeset 3512110, though no CISA KEV listing or public exploit code has been identified at time of analysis.
An Incorrect Privilege Assignment vulnerability (CWE-266) exists in the Salon Booking System Pro WordPress plugin versions prior to 10.30.12, allowing attackers to escalate privileges and potentially achieve account takeover. The vulnerability affects all versions of the salon-booking-plugin-pro from an unspecified baseline through version 10.30.11. This privilege escalation can be exploited by unauthenticated or low-privileged attackers to gain unauthorized administrative access to the booking system.
Stored cross-site scripting in the Salon Booking System WordPress plugin (Appointment Booking for Salons, Barbershops & Spas, all versions up to and including 10.31.9) lets unauthenticated attackers inject arbitrary JavaScript through the sln[<checkout-field-key>] checkout parameter, which is persisted and later executed when a user loads the affected page - in practice the admin customer view. Impact is conditional: the site must have at least one admin-configured custom checkout field of type Html or File, a documented but non-default plugin feature, so sites without such a field are not exploitable. No public exploit code has been identified at time of analysis, and the independent assessment rates the issue as a moderate, conditional risk rather than an emergency, downgrading the vendor's AC:L to AC:H because of the configuration dependency and the admin-context trigger.
Remote code execution in the Salon Booking System - Free Version WordPress plugin (all versions ≤ 10.30.32) lets a remote attacker write attacker-controlled PHP into the plugin's web-accessible translate-constants.php file by abusing the unprotected setCustomText AJAX handler. Because the handler lacks proper nonce validation (CWE-352 CSRF), an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can achieve full server-side code execution. Reported by Wordfence with a CVSS of 8.8; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Arbitrary file read in Salon Booking System plugin for WordPress (versions ≤10.30.25) allows unauthenticated remote attackers to exfiltrate sensitive local files by injecting malicious file paths into booking form fields, which are then attached to confirmation emails sent by the system. Wordfence identified this path traversal vulnerability (CWE-22) with a CVSS score of 7.5, exploitable without authentication or user interaction. The vulnerability is confirmed patched in version 10.30.26 via changeset 3512110, though no CISA KEV listing or public exploit code has been identified at time of analysis.
An Incorrect Privilege Assignment vulnerability (CWE-266) exists in the Salon Booking System Pro WordPress plugin versions prior to 10.30.12, allowing attackers to escalate privileges and potentially achieve account takeover. The vulnerability affects all versions of the salon-booking-plugin-pro from an unspecified baseline through version 10.30.11. This privilege escalation can be exploited by unauthenticated or low-privileged attackers to gain unauthorized administrative access to the booking system.