WordPress plugin · salon-booking-system
Is Salon Booking System safe?
Safe on 10.31.13 or newer.
The current version, 10.31.13, is past every affected range on record (47 of 47 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 47
- High or critical
- 17
- Exploited
- none
- Current version
- 10.31.13
- Last updated
- Oct 27, 2026
- Active installs
- 2,000+
Every recorded flaw
- Oct 19, 2026Salon Booking System: Does not enforce a minimum of zeroCVE-2026-110034 · fixed in 10.31.11 · reported by WPScanLow 3.7
- Oct 18, 2026Salon Booking System: Does not restrict one of its REST API endpoints to salon staffCVE-2026-110035 · fixed in 10.31.11 · reported by WPScanMedium 4.3
- Oct 18, 2026Salon Booking System: Does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filenameCVE-2026-110033 · fixed in 10.31.11 · reported by WPScanMedium 6.8
- Oct 18, 2026Salon Booking System: Does not restrictCVE-2026-110032 · fixed in 10.31.11 · reported by WPScanMedium 5.5
- Oct 18, 2026Salon Booking System: Does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accountsCVE-2026-110031 · fixed in 10.31.11 · reported by WPScanHigh 7.2
- Oct 16, 2026Salon Booking System: Does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST APICVE-2026-110015 · fixed in 10.31.9 · reported by WPScanHigh 8.8
- Oct 16, 2026Salon Booking System: Does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking statusCVE-2026-110014 · fixed in 10.31.9 · reported by WPScanMedium 5.3
- Oct 16, 2026Salon Booking System: Does not generate its booking-API access tokens from a secure random sourceCVE-2026-110013 · fixed in 10.31.9 · reported by WPScanMedium 4.8
- Oct 16, 2026Salon Booking System: Does not restrict several of its booking REST API routes to users with the appropriate capabilityCVE-2026-110012 · fixed in 10.31.3 · reported by WPScanMedium 4.3
- Oct 16, 2026Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: Stored Cross-Site ScriptingCVE-2026-109232 · affects up to 10.31.9 · reported by WordfenceHigh 7.2
- Oct 9, 2026Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94668 · affects up to 10.31.5 · reported by PatchstackHigh 7.1
- Oct 6, 2026Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.CVE-2026-105070 · affects up to 10.31.7 · reported by PatchstackHigh 8.8
- Sep 10, 2026Salon booking system: Missing AuthorizationCVE-2026-81793 · affects up to 10.31.9 · reported by PatchstackMedium 6.5
- Aug 13, 2026Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.CVE-2026-66453 · affects up to 10.30.26 · reported by PatchstackCritical 9.8
- Aug 10, 2026Salon Booking System: Does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callbackCVE-2026-17023 · affects up to 10.30.33 · reported by WPScanMedium 4.8
- Aug 10, 2026Salon Booking System: Does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation stepsCVE-2026-17022 · fixed in 10.30.34 · reported by WPScanHigh 7.5
- Aug 10, 2026Salon Booking System: Does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted bookingCVE-2026-17021 · fixed in 10.30.34 · reported by WPScanMedium 5.3
- Aug 10, 2026Salon Booking System: Does not verify that a requested booking belongs to the caller on one of its REST API endpointsCVE-2026-17020 · affects up to 10.31.0 · reported by WPScanMedium 4.3
- Jul 10, 2026Salon Booking System – Free Version: Cross-Site Request ForgeryCVE-2026-15070 · affects up to 10.30.32 · reported by WordfenceHigh 8.8
- Jul 1, 2026Salon Booking System: Does not have proper authorisation checks on one of its AJAX actionsCVE-2026-11887 · fixed in 10.30.20 · reported by WPScanMedium 4.3
- Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.CVE-2026-40768 · affects up to 10.30.24 · reported by PatchstackHigh 7.3
- Jun 15, 2026Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.CVE-2026-42666 · affects up to 10.30.25 · reported by PatchstackHigh 7.5
- May 2, 2026Salon Booking System – Free Version: Arbitrary File ReadCVE-2026-6320 · affects up to 10.30.25 · reported by WordfenceHigh 7.5
- Jan 22, 2026Salon booking system: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67954 · affects up to 10.30.3 · reported by PatchstackMedium 6.5
- Dec 9, 2025Salon booking system: Cross-Site Request Forgery (CSRF)CVE-2025-66531 · affects up to 10.30.3 · reported by PatchstackMedium 4.3
- Sep 11, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Unauthorized modification of dataCVE-2025-8492 · affects up to 10.22 · reported by WordfenceMedium 5.3
- May 19, 2025Salon booking system: Cross-Site Request Forgery (CSRF)CVE-2025-47583 · affects up to 10.16 · reported by PatchstackMedium 5.4
- May 15, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Does not sanitise and escape some of its settingsCVE-2024-9882 · fixed in 1.9.4 · reported by WPScanMedium 4.8
- Apr 4, 2025Salon booking system: Missing AuthorizationCVE-2025-32220 · affects up to 10.31.9 · reported by PatchstackMedium 5.4
- Apr 1, 2025Salon booking system: Incorrect Privilege AssignmentCVE-2025-31560 · affects up to 10.11 · reported by PatchstackHigh 7.2
- Oct 5, 2024Salon booking system: Authorization Bypass Through User-Controlled KeyCVE-2024-47316 · affects up to 10.9 · reported by PatchstackMedium 4.3
- Aug 29, 2024Salon booking system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-39658 · affects up to 10.7 · reported by PatchstackHigh 7.6
- Aug 19, 2024Salon booking system: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-43280 · affects up to 10.8.1 · reported by PatchstackMedium 4.7
- Jun 24, 2024Salon booking system: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37231 · affects up to 9.9 · reported by PatchstackHigh 8.6
- Jun 19, 2024Salon booking system: Arbitrary file uploadsCVE-2024-3229 · affects up to 10.2 · reported by WordfenceCritical 9.8
- Jun 8, 2024Salon booking system: Unauthorized access and modification of dataCVE-2024-4468 · affects up to 9.9 · reported by WordfenceMedium 4.3
- May 21, 2024Salon booking system: Arbitrary file deletionCVE-2024-4442 · affects up to 9.8 · reported by Wordfence1.2% oddsCritical 9.1
- May 17, 2024Salon booking system: Improper Privilege ManagementCVE-2023-48319 · affects up to 8.6 · reported by PatchstackMedium 6.8
- Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2603 · affects up to 9.6.5 · reported by WPScanMedium 6.3
- Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2439 · affects up to 9.6.5 · reported by WPScanMedium 4.8
- Apr 26, 2024Salon booking system: Does not have CSRF check in placeCVE-2024-2429 · affects up to 9.6.5 · reported by WPScanMedium 4.3
- Apr 17, 2024Salon booking system: Does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameterCVE-2024-2102 · fixed in 9.6.3 · reported by WPScanMedium 4.7
- Apr 17, 2024Salon booking system: Does not properly sanitize and escape the 'Mobile Phone' fieldCVE-2024-2101 · fixed in 9.6.3 · reported by WPScanMedium 5.7
- Mar 29, 2024Salon booking system: Unrestricted Upload of File with Dangerous TypeCVE-2024-30510 · affects up to 9.5 · reported by PatchstackCritical 10
- Jun 27, 2023Salon Booking System: Cross-Site Request ForgeryCVE-2023-3427 · affects up to 8.4.6 · reported by WordfenceMedium 5.4
- Dec 4, 2022Salon booking system versions prior to 7.9: Cross-site scriptingCVE-2022-43487 · fixed in 7.9 · reported by vultures@jpcert.or.jpMedium 6.1
- Jul 12, 2021Salon booking system: Does not properly sanitise and escape the First Name fieldCVE-2021-24429 · fixed in 6.3.1 · reported by WPScan1.2% oddsMedium 6.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.