CVE-2026-15070: Cross-Site Request Forgery (CSRF)

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inje...

CVE-2026-6320: Improper Limitation of a Pathname to a Restricted Directory

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email...

PT-2022-13526

Name of the Vulnerable Software and Affected Versions The Salon booking system Free and Pro WordPress plugins versions prior to 7.6.3 Description The issue is related to improper authorization in some endpoints of the plugin, which could allow customers to access all bookings and other customers'...

PT-2022-13525

Name of the Vulnerable Software and Affected Versions The Salon booking system Free and pro WordPress plugins versions prior to 7.6.3 Description The issue allows unauthenticated users to search other's bookings and retrieve sensitive information, including full name, email, and phone number of t...

CVE-2017-2168

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2017-15228

Name of the Vulnerable Software and Affected Versions WP Booking System Free versions prior to 1.4 WP Booking System Premium versions prior to 3.7 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For W...