CVE-2026-81793

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

EUVD-2026-75524

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

CVE-2026-81793

An unauthenticated Broken Access Control vulnerability affects the WordPress Salon booking system plugin in versions 10.31.5 and earlier . Discovered by Tiago Ventura (@perses), the flaw allows attackers to access or modify data with low integrity and low availability impact without requiring any...

CVE-2026-81793 WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

PT-2026-89438

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...

WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard vulnerability discovered by Usama Arshad in WordPress Plugin Salon booking system versions 10.30.34...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress Salon Booking System plugin < 10.30.20 - Subscriber+ Booking Approval Bypass vulnerability

Subscriber+ Booking Approval Bypass vulnerability discovered by kevin@OPCIA in WordPress Plugin Salon booking system versions 10.30.20...

WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...

CVE-2026-66453

Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...

EUVD-2026-57873

Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...

PT-2026-71560

Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...

CVE-2026-17023

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17022

The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyin...

CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023

The Salon Booking System WordPress plugin (versions

EUVD-2026-55004

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...