VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas security & vulnerabilities

salon-booking-system— active installsLast vulnerability Oct 16, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
50Known vulnerabilities
  • Critical4
  • High10
  • Medium35
  • Low1
Vulnerabilities per year
2021: 1 vulnerability1212022: 4 vulnerabilities4222023: 3 vulnerabilities3232024: 13 vulnerabilities13242025: 5 vulnerabilities5252026: 24 vulnerabilities2426

All Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerabilities

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Missing Authorization
≤10.31.10Update to 10.31.11
CVE-2026-110032
High8.810.31.10 - Authenticated (Salon Staff+) Privilege Escalation
10.17 – 10.31.10Update to 10.31.11
CVE-2026-110031
Medium6.4Authenticated (Salon Staff+) Stored Cross-Site Scripting
≤10.31.10Update to 10.31.11
CVE-2026-110033
Medium5.3Unauthenticated Negative Booking Total Creation
≤10.31.10Update to 10.31.11
CVE-2026-110034
Medium4.3Missing Authorization
≤10.31.10Update to 10.31.11
CVE-2026-110035
High7.2Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
≤10.31.9Update to 10.31.10
CVE-2026-109232
Medium5.3Missing Authorization
≤10.31.8Update to 10.31.9
CVE-2026-110014
Medium4.3Authenticated (Subscriber+) Information Exposure
≤10.31.2Update to 10.31.3
CVE-2026-110012
Medium4.3Cross-Site Request Forgery
≤10.31.8Update to 10.31.9
CVE-2026-110015
Medium6.5Insufficient Authorization to Booking API Access
≤10.31.8Update to 10.31.9
CVE-2026-110013
High7.3Unauthenticated Privilege Escalation
≤10.31.7Update to 10.31.9
CVE-2026-105070
High7.2Unauthenticated Stored Cross-Site Scripting
≤10.31.5Update to 10.31.6
CVE-2026-94668
Medium5.3Missing Authorization
≤10.31.5No patch available
CVE-2026-81793
Medium4.3Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass
≤10.30.19Update to 10.30.20
CVE-2026-11887
Medium5.3Missing Authorization
≤10.30.26Update to 10.30.27
CVE-2026-66453
Medium5.3Missing Authorization
≤10.30.33Update to 10.30.34
CVE-2026-17021
Medium5.3Missing Authorization to Unauthenticated Google Calendar Connection Hijack
<10.31.3Update to 10.31.3
CVE-2026-17023
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure
<10.31.3Update to 10.31.3
CVE-2026-17020
Medium5.3Unauthenticated Booking Information Disclosure
≤10.30.33Update to 10.30.34
CVE-2026-17022
High8.8Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
≤10.30.32Update to 10.30.33
CVE-2026-15070
Medium5.3Missing Authorization
≤10.30.25Update to 10.30.26
CVE-2026-42666
High7.5Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
≤10.30.25Update to 10.30.26
CVE-2026-6320
Medium5.3Unauthenticated Insecure Direct Object Reference
≤10.30.24Update to 10.30.25
CVE-2026-40768
Low3.1Authenticated (Subscriber+) Information Exposure
≤10.30.3Update to 10.30.4
CVE-2025-67954
Medium4.3Cross-Site Request Forgery
≤10.30.3Update to 10.30.4
CVE-2025-66531
Medium5.3Missing Authorization to Unauthenticated AJAX Actions Execution
≤10.22Update to 10.24
CVE-2025-8492
Medium4.3Cross-Site Request Forgery to Arbitrary Post/Page Deletion
≤10.16Update to 10.17
CVE-2025-47583
Medium4.3Missing Authorization
≤10.29.6No patch available
CVE-2025-32220
High8.8Authenticated Privilege Escalation
≤10.11Update to 10.15
CVE-2025-31560
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤10.9Update to 10.9.1
CVE-2024-47316
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤10.9.3Update to 10.9.4
CVE-2024-9882
Medium6.1Unauthenticated Open Redirect
≤10.8.1Update to 10.9
CVE-2024-43280
Critical9.1Authenticated (Administrator+) SQL Injection
≤10.7Update to 10.8
CVE-2024-39658
Critical9.8Unauthenticated Arbitrary File Upload
≤10.2Update to 10.3
CVE-2024-3229
Medium4.3Missing Authorization
≤9.9Update to 10.0
CVE-2024-4468
Critical9.1Unauthenticated Arbitrary File Deletion
≤9.9Update to 10.0
CVE-2024-4442
Medium4.3Cross-Site Request Forgery to Settings Update
≤9.6.5Update to 9.6.6
CVE-2024-2429
Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤9.6.5Update to 9.6.6
CVE-2024-2439
Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings
≤9.6.5Update to 9.6.6
CVE-2024-2603
Critical10.0Unauthenticated Arbitrary File Upload
≤9.5Update to 9.5.1
CVE-2024-30510
High7.2Unauthenticated Stored Cross-Site Scripting via 'sms_prefix'
≤9.6.2Update to 9.6.3
CVE-2024-2102
Medium5.4Authenticated (Customer+) Stored Cross-Site Scripting
≤9.6.2Update to 9.6.3
CVE-2024-2101
High7.2Authenticated (Editor+) Privilege Escalation
<8.7Update to 8.7
CVE-2023-48319
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium5.4Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer
≤8.4.7Update to 8.4.8
CVE-2023-3427
Medium6.1Reflected Cross-Site Scripting
≤7.9Update to 7.9.4
CVE-2022-43487
High7.5Sensitive Information Disclosure
≤7.6.2Update to 7.6.3
CVE-2022-0920
Medium5.3Sensitive Data Disclosure
≤7.6.2Update to 7.6.3
CVE-2022-0919
Medium6.3Missing Authorization Checks
all versionsNo patch available
CVE-2022-4974
Medium6.1Stored Cross-Site Scripting
<6.3.1Update to 6.3.1
CVE-2021-24429

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: common questions

Does Salon Booking System – Appointment Booking for Salons, Barbershops & Spas have known vulnerabilities?

Yes. VulnCrest Radar lists 50 known vulnerabilities in Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: 4 critical, 10 high, 35 medium, 1 low. At least one is not fixed in the latest version.

How do I check which version of Salon Booking System – Appointment Booking for Salons, Barbershops & Spas I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerability?

CVE-2026-110032, published Oct 16, 2026: Salon Booking System <= 10.31.10 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerability listed in CISA KEV?

No. None of the known Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?