Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
Why it matters now
EPSS 0.01242 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Salon booking system (Salon Booking System): 6.3.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dimitri Grassi | Salon booking system | 6.3.1 to before 6.3.1 | 6.3.1 | Patch available | CNA |
- Salon booking system VendorDimitri Grassi Affected 6.3.1 to before 6.3.1 Fixed in 6.3.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:* | before 6.3.1 | Vulnerable | Dimitri Grassi |
- cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:* Versions before 6.3.1 Vulnerable ·Dimitri Grassi
Remediation
- Fix · CNA Salon booking system (Salon Booking System) Fixed in 6.3.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24429
- 2026-10-03 Alias added: GHSA-9pm7-cw8h-4w28
References
More Dimitri Grassi Salon Booking System vulnerabilities
- TI-2024-01952 WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) CVSS 3.1MEDIUM 5.7
- TI-2024-09168 Salon Booking System < 10.9.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2024-01953 Salon booking system < 9.6.3 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 4.7
- TI-2024-02257 Salon booking system <= 9.6.5 - Settings Update via CSRF CVSS 3.1MEDIUM 4.3
- TI-2024-20234 WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0
- TI-2024-03027 Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-24429 · CVE Program
- CVE-2021-24429 · NVD
- FIRST EPSS
- GHSA-9pm7-cw8h-4w28 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences