CVE-2021-24429: Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-12 · updated 2026-06-17
Weakness: CWE-79

Description

The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.

Affected products

Salon booking system: before 6.3.1 — fixed in 6.3.1

How to fix

Upgrade to a fixed version: Salon booking system 6.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24429 or the next vulnerability affects your stack