Salon Booking System vulnerabilities

We track 8 vulnerabilities in Salon Booking System products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 18, 2026.

8vulnerabilities

2critical

6high

0exploited

8.0average CVSS score

Latest Salon Booking System vulnerabilities

7.2 High severity
Salon Booking System: Improper Privilege Management
CVE-2026-110031Oct 18, 2026Salon Booking System
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and tak
8.8 High severity
Salon Booking System: Cross-Site Request Forgery
CVE-2026-110015Oct 16, 2026Salon Booking System
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers w
7.5 High severity
Salon Booking System: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2026-17022Aug 10, 2026Salon Booking System
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, includ
7.2 High severity
Salon booking system: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-39658Aug 29, 2024Salon Booking System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.This issue affects Salon booking system: from n/a through 10.7.
9.1 Critical severity
Salon booking system: Improper Limitation of a Pathname to a Restricted Directory
CVE-2024-37231Jun 24, 2024Salon Booking System
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.This issue affects Salon booking system: from n/a through 9.9.
7.2 High severity
Salon booking system: Improper Privilege Management
CVE-2023-48319May 17, 2024Salon Booking System
Improper Privilege Management vulnerability in Salon Booking System Salon booking system allows Privilege Escalation.This issue affects Salon booking system: from n/a through 8.6.
9.8 Critical severity
Salon booking system: Unrestricted Upload of File with Dangerous Type
CVE-2024-30510Mar 29, 2024Salon Booking System
Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5.
7.5 High severity
Salon booking system: Incorrect Authorization
CVE-2022-0920Apr 11, 2022Salon Booking SystemEPSS 1.45%
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data