Skip to content
Noroxi

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas

salon-booking-system · plugin

Known security vulnerabilities for Salon Booking System – Appointment Booking for Salons, Barbershops & Spas. Find out in seconds which version runs on your site with WP Lens.

23 known vulnerabilities

5 critical · 16 exploitable without logging in · latest Sep 10, 2026

Listed on wordpress.org · latest 10.31.9 · last updated Oct 3, 2026 · 2K+ installs

wordpress.org status checked on Oct 4, 2026

Vulnerabilities

  • CVE-2026-66453unauthenticated≤ 10.30.26

    WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

    Critical 9.8

  • CVE-2024-3229unauthenticated≤ 10.2

    Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload

    Critical 9.8

  • CVE-2024-30510unauthenticated≤ 9.5

    WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability

    Critical 9.8

  • CVE-2024-37231unauthenticated≤ 9.9

    WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerability

    Critical 9.1

  • CVE-2024-4442unauthenticated≤ 9.9

    Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion

    Critical 9.1

  • CVE-2026-15070unauthenticated · needs a click≤ 10.30.32

    Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter

    High 8.8

  • CVE-2025-32220login required≤ 10.31.8

    WordPress Salon booking system plugin <= 10.31.8 - Broken Access Control vulnerability

    High 8.8

  • CVE-2024-47316login required≤ 10.9

    WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability

    High 8.8

  • CVE-2026-42666unauthenticated≤ 10.30.25

    WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability

    High 7.5

  • CVE-2026-6320unauthenticated≤ 10.30.25

    Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal

    High 7.5

  • CVE-2026-40768unauthenticated≤ 10.30.24

    WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability

    High 7.3

  • CVE-2025-31560high privilege≤ 10.15

    WordPress Salon booking system plugin < 10.15 - Privilege Escalation vulnerability

    High 7.2

  • CVE-2024-39658high privilege≤ 10.7

    WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerability

    High 7.2

  • CVE-2023-48319editor+≤ 8.6

    WordPress Salon booking system plugin < 8.7 - Editor+ Privilege Escalation vulnerability

    High 7.2

  • CVE-2026-81793unauthenticated≤ 10.31.8

    WordPress Salon booking system plugin <= 10.31.8 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2025-67954login required≤ 10.30.3

    WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability

    Medium 6.5

  • CVE-2024-43280unauthenticated · needs a click≤ 10.8.1

    WordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerability

    Medium 6.1

  • CVE-2022-43487unauthenticated · needs a click

    Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbit

    Medium 6.1

  • CVE-2025-47583unauthenticated · needs a click≤ 10.16

    WordPress Salon booking system plugin <= 10.16 - CSRF to Arbitrary Content Deletion vulnerability

    Medium 5.4

  • CVE-2024-4468subscriber+≤ 9.9

    Salon booking system <= 9.9 - Missing Authorization

    Medium 5.4

  • CVE-2025-8492unauthenticated≤ 10.22

    Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution

    Medium 5.3

  • CVE-2025-66531unauthenticated · needs a click≤ 10.30.3

    WordPress Salon booking system plugin <= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 4.3

  • CVE-2023-3427unauthenticated · needs a click≤ 8.4.7

    Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory