sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total39
Critical4
High11
Medium24
Reset
Showing 1-20 of 39 records
Threat Entry Updated 2026-08-26

Salon Booking System - Security Vulnerability (CVE-2026-17022)

The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.

PLUGIN Salon Booking System

CVE-2026-17022

HIGH CVSS 7.5 2026-08-10
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Salon Booking System - Security Vulnerability (CVE-2026-17021)

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

PLUGIN Salon Booking System

CVE-2026-17021

MEDIUM CVSS 5.3 2026-08-10
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Salon Booking System - Broken Access Control (CVE-2026-17023)

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

PLUGIN Salon Booking System

CVE-2026-17023

MEDIUM CVSS 4.8 2026-08-10
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Salon Booking System - Security Vulnerability (CVE-2026-17020)

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.

PLUGIN Salon Booking System

CVE-2026-17020

MEDIUM CVSS 4.3 2026-08-10
Open Full Technical Breakdown
Threat Entry Updated 2026-07-10

Salon Booking System - Remote Code Execution (CVE-2026-15070)

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into the web-accessible translate-constants.php file within the plugin directory, enabling remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. sanitize_text_field() is applied to…

PLUGIN Salon Booking System

CVE-2026-15070

HIGH CVSS 8.8 2026-07-10
Open Full Technical Breakdown
Threat Entry Updated 2026-07-01

Salon Booking System - Security Vulnerability (CVE-2026-11887)

The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System WordPress plugin before 10.30.20 setting and bypass the manual approval of new bookings.

PLUGIN Salon Booking System

CVE-2026-11887

MEDIUM CVSS 4.3 2026-07-01
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Salon Booking System - Security Vulnerability (CVE-2026-6320)

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.

PLUGIN Salon Booking System

CVE-2026-6320

HIGH CVSS 7.5 2026-05-02
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Salon Booking System - Broken Access Control (CVE-2025-8492)

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticated attackers to execute AJAX actions, including limited file uploads.

PLUGIN Salon Booking System

CVE-2025-8492

MEDIUM CVSS 5.3 2025-09-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Salon Booking System - Cross-Site Scripting (XSS) (CVE-2024-9882)

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Salon Booking System

CVE-2024-9882

MEDIUM CVSS 4.8 2025-05-15
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.