CVE-2026-110034 Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code

The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total...

WordPress Salon Booking System plugin < 10.31.11 - Unauthenticated Negative Booking Total vulnerability

Unauthenticated Negative Booking Total vulnerability discovered by vuxvinh in WordPress Plugin Salon booking system versions 10.31.11...

CVE-2026-110034 Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code

The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total...

CVE-2026-110034

The Salon Booking System WordPress plugin (versions prior to 10.31.11 ) is vulnerable to an unauthenticated negative booking total flaw. The root cause is a failure to enforce a minimum value of zero when subtracting a fixed-amount discount from a booking's total. An unauthenticated visitor posse...

WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...

CVE-2026-17021

The Salon Booking System WordPress plugin (Free Version) is vulnerable to unauthenticated arbitrary booking total tampering in versions before 10.30.34 . The root cause is a failure to properly restrict access to specific booking-modification AJAX actions and a lack of ownership verification for ...

CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...