Salon booking system

Software Type	Plugin
Software Slug	salon-booking-system (view on wordpress.org)
Software Status	Active
Software Author	wordpresschef
Software Website	salonbookingsystem.com
Software Downloads	555,970
Software Active Installs	5,000
Software Record Last Updated	May 2, 2024

14 Vulnerabilities

Salon booking system <= 9.6.5 - Cross-Site Request Forgery to Settings Update

4.3

CVE-2024-2429

Apr 26, 2024

Researcher: Bob Matyas

Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings

4.4

CVE-2024-2603

Apr 5, 2024

Researcher: Bob Matyas

Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVE-2024-2439

Apr 5, 2024

Researcher: cyc707

Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload

10.0

CVE-2024-30510

Mar 28, 2024

Researcher: stealthcopter

Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting

5.4

CVE-2024-2101

Mar 27, 2024

Researcher: Priyanka Pande

Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting via 'sms_prefix'

7.2

CVE-2024-2102

Mar 27, 2024

Researcher: cyc707

Salon booking system < 8.7 - Authenticated (Editor+) Privilege Escalation

7.2

CVE-2023-48319

Nov 23, 2023

Researcher: lttn

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

6.1

CVE-2023-33999

Jul 18, 2023

Researcher: Rafie Muhammad

Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

5.4

CVE-2023-3427

Jun 27, 2023

Researcher: István Márton

Salon booking system <= 7.9 - Reflected Cross-Site Scripting

6.1

CVE-2022-43487

Nov 8, 2022

Researcher: Gen Sato

Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Data Disclosure

5.3

CVE-2022-0919

Mar 21, 2022

Researcher: Huli, Cymetrics

Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Information Disclosure

7.5

CVE-2022-0920

Mar 21, 2022

Researcher: Huli, Cymetrics

Freemius SDK <= 2.4.2 - Missing Authorization Checks

6.3

CVE ID Unknown

Mar 4, 2022

Researchers:

Salon booking system < 6.3.1 - Stored Cross-Site Scripting

6.1

CVE-2021-24429

Jun 21, 2021

Researcher: Phu Tran

Title	CVE ID	CVSS	Researchers	Date
Salon booking system <= 9.6.5 - Cross-Site Request Forgery to Settings Update	CVE-2024-2429	4.3	Bob Matyas	April 26, 2024
Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings	CVE-2024-2603	4.4	Bob Matyas	April 5, 2024
Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting	CVE-2024-2439	4.4	cyc707	April 5, 2024
Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload	CVE-2024-30510	10.0	stealthcopter	March 28, 2024
Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting	CVE-2024-2101	5.4	Priyanka Pande	March 27, 2024
Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting via 'sms_prefix'	CVE-2024-2102	7.2	cyc707	March 27, 2024
Salon booking system < 8.7 - Authenticated (Editor+) Privilege Escalation	CVE-2023-48319	7.2	lttn	November 23, 2023
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	CVE-2023-33999	6.1	Rafie Muhammad	July 18, 2023
Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer	CVE-2023-3427	5.4	István Márton	June 27, 2023
Salon booking system <= 7.9 - Reflected Cross-Site Scripting	CVE-2022-43487	6.1	Gen Sato	November 8, 2022
Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Data Disclosure	CVE-2022-0919	5.3	Huli, Cymetrics	March 21, 2022
Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Information Disclosure	CVE-2022-0920	7.5	Huli, Cymetrics	March 21, 2022
Freemius SDK <= 2.4.2 - Missing Authorization Checks		6.3		March 4, 2022
Salon booking system < 6.3.1 - Stored Cross-Site Scripting	CVE-2021-24429	6.1	Phu Tran	June 21, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation