CVE-2026-94668: WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability

Q: Which deployments are affected?

Salon booking system versions through 10.31.5 are affected. The available information does not identify a safe fixed version.

Q: What does an attacker need to exploit this issue?

The issue is reflected XSS and is network-accessible with low attack complexity. It requires no attacker privileges, but it does require user interaction.

Q: What is the likely impact if exploitation succeeds?

The reported CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation can affect a security scope beyond the vulnerable plugin.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.

Affected Software

1 affected component

Dimitri Grassi Salon booking system<=10.31.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Salon booking system plugin to a version that resolves this vulnerability.
Fixed in 10.31.6

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Salon booking system versions through 10.31.5 are affected. The available information does not identify a safe fixed version.

What does an attacker need to exploit this issue?

The issue is reflected XSS and is network-accessible with low attack complexity. It requires no attacker privileges, but it does require user interaction.

What is the likely impact if exploitation succeeds?

The reported CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation can affect a security scope beyond the vulnerable plugin.

CVE-2026-94668: WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?