Salon Booking System

WordPress plugin · salon-booking-system · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Salon Booking System on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key CVE.org	>=10.17, <10.31.11	v10.31.11	CVE-2026-110031	Oct 18, 2026
HIGH CVSS 8.8	Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF CVE.org	>=0, <10.31.9	v10.31.9	CVE-2026-110015	Oct 16, 2026
HIGH CVSS 7.5	Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard CVE.org	>=0, <10.30.34	v10.30.34	CVE-2026-17022	Aug 10, 2026
MEDIUM CVSS 5.5	Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor CVE.org	>=0, <10.31.11	v10.31.11	CVE-2026-110032	Oct 18, 2026
MEDIUM CVSS 6.8	Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url' CVE.org	>=0, <10.31.11	v10.31.11	CVE-2026-110033	Oct 18, 2026
MEDIUM CVSS 4.3	Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route CVE.org	>=0, <10.31.11	v10.31.11	CVE-2026-110035	Oct 18, 2026
MEDIUM CVSS 4.3	Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming CVE.org	>=0, <10.31.3	v10.31.3	CVE-2026-110012	Oct 16, 2026
MEDIUM CVSS 4.8	Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token CVE.org	>=0, <10.31.9	v10.31.9	CVE-2026-110013	Oct 16, 2026
MEDIUM CVSS 5.3	Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status CVE.org	>=0, <10.31.9	v10.31.9	CVE-2026-110014	Oct 16, 2026
MEDIUM CVSS 4.8	Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback CVE.org	<=10.30.33	unfixed	CVE-2026-17023	Aug 10, 2026
MEDIUM CVSS 4.3	Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure CVE.org	<=10.31.0	unfixed	CVE-2026-17020	Aug 10, 2026
MEDIUM CVSS 5.3	Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering CVE.org	>=0, <10.30.34	v10.30.34	CVE-2026-17021	Aug 10, 2026
MEDIUM CVSS 4.3	Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass CVE.org	>=0, <10.30.20	v10.30.20	CVE-2026-11887	Jul 1, 2026
LOW CVSS 3.7	Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code CVE.org	>=0, <10.31.11	v10.31.11	CVE-2026-110034	Oct 19, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.