WordPress plugin
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical4
- High10
- Medium35
- Low1
All Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation 10.17 – 10.31.10Update to 10.31.11 | CVE-2026-110031 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX ≤10.31.9Update to 10.31.10 | CVE-2026-109232 | |
| High7.3 | Unauthenticated Privilege Escalation ≤10.31.7Update to 10.31.9 | CVE-2026-105070 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤10.31.5Update to 10.31.6 | CVE-2026-94668 | |
| High8.8 | Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter ≤10.30.32Update to 10.30.33 | CVE-2026-15070 | |
| High7.5 | Unauthenticated Arbitrary File Read via Booking File Field Path Traversal ≤10.30.25Update to 10.30.26 | CVE-2026-6320 | |
| High8.8 | Authenticated Privilege Escalation ≤10.11Update to 10.15 | CVE-2025-31560 | |
| Critical9.1 | Authenticated (Administrator+) SQL Injection ≤10.7Update to 10.8 | CVE-2024-39658 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤10.2Update to 10.3 | CVE-2024-3229 | |
| Critical9.1 | Unauthenticated Arbitrary File Deletion ≤9.9Update to 10.0 | CVE-2024-4442 | |
| Critical10.0 | Unauthenticated Arbitrary File Upload ≤9.5Update to 9.5.1 | CVE-2024-30510 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'sms_prefix' ≤9.6.2Update to 9.6.3 | CVE-2024-2102 | |
| High7.2 | Authenticated (Editor+) Privilege Escalation <8.7Update to 8.7 | CVE-2023-48319 | |
| High7.5 | Sensitive Information Disclosure ≤7.6.2Update to 7.6.3 | CVE-2022-0920 |
- High8.810.31.10 - Authenticated (Salon Staff+) Privilege Escalation
10.17 – 10.31.10Update to 10.31.11
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
≤10.31.9Update to 10.31.10
- High7.3Unauthenticated Privilege Escalation
≤10.31.7Update to 10.31.9
- High7.2Unauthenticated Stored Cross-Site Scripting
≤10.31.5Update to 10.31.6
- High8.8Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
≤10.30.32Update to 10.30.33
- High7.5Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
≤10.30.25Update to 10.30.26
- High8.8Authenticated Privilege Escalation
≤10.11Update to 10.15
- Critical9.1Authenticated (Administrator+) SQL Injection
≤10.7Update to 10.8
- Critical9.8Unauthenticated Arbitrary File Upload
≤10.2Update to 10.3
- Critical9.1Unauthenticated Arbitrary File Deletion
≤9.9Update to 10.0
- Critical10.0Unauthenticated Arbitrary File Upload
≤9.5Update to 9.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'sms_prefix'
≤9.6.2Update to 9.6.3
- High7.2Authenticated (Editor+) Privilege Escalation
<8.7Update to 8.7
- High7.5Sensitive Information Disclosure
≤7.6.2Update to 7.6.3
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: common questions
Does Salon Booking System – Appointment Booking for Salons, Barbershops & Spas have known vulnerabilities?
Yes. VulnCrest Radar lists 50 known vulnerabilities in Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: 4 critical, 10 high, 35 medium, 1 low. At least one is not fixed in the latest version.
How do I check which version of Salon Booking System – Appointment Booking for Salons, Barbershops & Spas I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerability?
CVE-2026-110032, published Oct 16, 2026: Salon Booking System <= 10.31.10 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerability listed in CISA KEV?
No. None of the known Salon Booking System – Appointment Booking for Salons, Barbershops & Spas vulnerabilities is currently listed in the CISA KEV catalog.