Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Salon Booking System 10.31.11 Clear all filters
TI-2026-76035 CVE-2026-110035 · GHSA-v3rv-f35h-88gq

Salon Booking System discloses hidden coupon codes to subscribers

Priority LOW 19

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configure…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00162 Published 2026-10-18 Fixed in 10.31.11 CWE-284
TI-2026-76034 CVE-2026-110033 · GHSA-6fxp-r7r3-93x6

Stored XSS and SSRF in Salon Booking System WordPress plugin

Priority LOW 31

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen fil…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00229 Published 2026-10-18 Fixed in 10.31.11 CWE-79
TI-2026-76033 CVE-2026-110032 · GHSA-v936-49xf-58f5

Missing authorization in Salon Booking System lets staff demote administrators

Priority LOW 24

The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker r…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00215 Published 2026-10-18 Fixed in 10.31.11 CWE-863
TI-2026-76032 CVE-2026-110031 · GHSA-wpj6-8qpm-3rhw

Privilege escalation to administrator in Salon Booking System plugin

Priority LOW 33

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escal…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00249 Published 2026-10-18 Fixed in 10.31.11 CWE-269