CVE-2026-110033: Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'

Q: Who can exploit this issue?

An authenticated user with the Salon Staff role or any higher role can exploit it. The issue is therefore most relevant to sites that grant Salon Staff access to untrusted or minimally trusted users.

Q: What access or interaction is required for impact?

The attacker needs a Salon Staff-or-higher account and must supply an image URL through the affected Salon REST functionality. For stored XSS to execute, someone must open the malicious SVG after it has been stored in the publicly accessible location.

Q: What can an attacker access or do through this flaw?

They can cause the server to fetch internal-only resources and write the response to a public location under an attacker-chosen filename, potentially disclosing that content. They can also store a malicious SVG that executes arbitrary script in the site's origin when opened.

Q: How can exposure be reduced before updating?

Restrict the Salon Staff role and higher roles to trusted users, since those roles can invoke the affected functionality. Avoid allowing untrusted users to submit image URLs through the Salon REST feature.

Published Oct 18, 2026

Updated

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.

Affected Software

1 affected component

Salon Booking System Salon Booking System<10.31.11

Event History

Oct 18, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with the Salon Staff role or any higher role can exploit it. The issue is therefore most relevant to sites that grant Salon Staff access to untrusted or minimally trusted users.

What access or interaction is required for impact?

The attacker needs a Salon Staff-or-higher account and must supply an image URL through the affected Salon REST functionality. For stored XSS to execute, someone must open the malicious SVG after it has been stored in the publicly accessible location.

What can an attacker access or do through this flaw?

They can cause the server to fetch internal-only resources and write the response to a public location under an attacker-chosen filename, potentially disclosing that content. They can also store a malicious SVG that executes arbitrary script in the site's origin when opened.

How can exposure be reduced before updating?

Restrict the Salon Staff role and higher roles to trusted users, since those roles can invoke the affected functionality. Avoid allowing untrusted users to submit image URLs through the Salon REST feature.

CVE-2026-110033: Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for impact?

What can an attacker access or do through this flaw?

How can exposure be reduced before updating?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or interaction is required for impact?

What can an attacker access or do through this flaw?

How can exposure be reduced before updating?