The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Vendor | Product | Version | CPE |
---|---|---|---|
salonbookingsystem | salon_booking_system | * | cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:*:*:* |