What’s Vulnerable › Products

Salon booking system vulnerabilities

49 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your Salon booking system version is affected

Latest Salon booking system vulnerabilities

• CVE-2026-110034 — Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code (CVSS 3.7)
• CVE-2026-110035 — Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route (CVSS 4.3)
• CVE-2026-110033 — Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url' (CVSS 6.8)
• CVE-2026-110032 — Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor (CVSS 5.5)
• CVE-2026-110031 — Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key (CVSS 7.2)
• CVE-2026-110015 — Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF (CVSS 8.8)
• CVE-2026-110014 — Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status (CVSS 5.3)
• CVE-2026-110013 — Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token (CVSS 4.8)
• CVE-2026-110012 — Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming (CVSS 4.3)
• CVE-2026-94668 — WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-105070 — WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability (CVSS 8.8)
• CVE-2026-81793 — WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability (CVSS 6.5)
• CVE-2026-66453 — WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability (CVSS 9.8)
• CVE-2026-17023 — Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback (CVSS 4.8)
• CVE-2026-17022 — Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard (CVSS 7.5)
• CVE-2026-17021 — Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering (CVSS 5.3)
• CVE-2026-17020 — Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure (CVSS 4.3)
• CVE-2026-15070 — Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter (CVSS 8.8)
• CVE-2026-11887 — Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass (CVSS 4.3)
• CVE-2026-40768 — WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.3)
• CVE-2026-42666 — WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-6320 — Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal (CVSS 7.5)
• CVE-2025-67954 — WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability (CVSS 6.5)
• CVE-2025-66531 — WordPress Salon booking system plugin <= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
• CVE-2025-8492 — Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution (CVSS 5.3)