CVE-2026-17022

The Salon booking system plugin versions up to 10.30.26 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff. This allows any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename. This allows users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.

The Salon Booking System plugin for WordPress (versions up to and including 10.31.9) is vulnerable to stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Salon booking system plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 10.31.5. An attacker can exploit this to execute a malicious script in the victim's browser.

Unauthenticated Privilege Escalation vulnerability in Salon booking system up to version 10.31.7 allows an unauthenticated attacker to escalate privileges.

Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.

The Salon Booking System WordPress plugin through version 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users. This allows an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.