Salon Booking System (Unknown) - vulnerabilities (CVEs)
22 CVEs, 9 in the last 30 days, 2 known versions, newest CVE from 2026-10-19. Vendor: Unknown.
CVEs of Salon Booking System
- CVE-2026-110034 - CVSS 3.7 (low), 2026-10-19: The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total,…
- CVE-2026-110033 - CVSS 6.8 (medium), 2026-10-18: The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response…
- CVE-2026-110032 - CVSS 5.5 (medium), 2026-10-18: The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management…
- CVE-2026-110031 - CVSS 7.2 (high), 2026-10-18: The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to…
- CVE-2026-110035 - CVSS 4.3 (medium), 2026-10-18: The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user,…
- CVE-2026-110012 - CVSS 4.3 (medium), 2026-10-16: The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability,…
- CVE-2026-110015 - CVSS 8.8 (high), 2026-10-16: The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce…
- CVE-2026-110014 - CVSS 5.3 (medium), 2026-10-16: The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user…
- CVE-2026-110013 - CVSS 4.8 (medium), 2026-10-16: The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them…
- CVE-2026-17023 - CVSS 4.8 (medium), 2026-08-10: The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar…
- CVE-2026-17020 - CVSS 4.3 (medium), 2026-08-10: The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints,…
- CVE-2026-17022 - CVSS 7.5 (high), 2026-08-10: The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard…
- CVE-2026-17021 - CVSS 5.3 (medium), 2026-08-10: The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not…
- CVE-2026-11887 - CVSS 4.3 (medium), 2026-07-01: The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated…
- CVE-2024-9882 - CVSS 4.8 (medium), 2025-05-15: The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its…
- CVE-2024-2603 - CVSS 6.3 (medium), 2024-04-26: The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as…
- CVE-2024-2439 - CVSS 4.8 (medium), 2024-04-26: The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as…
- CVE-2024-2429 - CVSS 4.3 (medium), 2024-04-26: The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a…
- CVE-2024-2102 - CVSS 4.7 (medium), 2024-04-17: The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking…
- CVE-2024-2101 - CVSS 5.7 (medium), 2024-04-17: The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing…
- CVE-2022-0919 - CVSS 5.3 (medium), 2022-04-11: The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated…
- CVE-2022-0920 - CVSS 7.5 (high), 2022-04-11: The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to…
