Read the docs
TI-2024-01953 Aliases CVE-2024-2102GHSA-pjpc-v23w-hch2

Salon booking system < 9.6.3 - Unauthenticated Stored XSS

Priority MEDIUM 55CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and the malicious script is executed in the admin context.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00464 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Salon booking system (Unknown): 9.6.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSalon booking systembefore 9.6.39.6.3Patch availableCNA
  • Salon booking system VendorUnknown Affected before 9.6.3 Fixed in 9.6.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:*before 9.6.3VulnerableDimitri Grassi
  • cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:* Versions before 9.6.3 Vulnerable ·Dimitri Grassi

Remediation

  • Fix · CNA Salon booking system (Unknown) Fixed in 9.6.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Salon booking system 9.6.3

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2024-01952 WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)Priority MEDIUM 59
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2102
  2. 2026-10-03 Alias added: GHSA-pjpc-v23w-hch2

References

Exploit 1

  • TI-2024-01952 WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) CVSS 3.1MEDIUM 5.7
  • TI-2024-09168 Salon Booking System < 10.9.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2024-02257 Salon booking system <= 9.6.5 - Settings Update via CSRF CVSS 3.1MEDIUM 4.3
  • TI-2024-20234 WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-03027 Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2024-24746 WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerability CVSS 3.1CRITICAL 9.1
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences