CVE-2026-94668: WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Salon booking system pluginto a version that resolves this vulnerability.Fixed in 10.31.6
Event History
Frequently Asked Questions
Which deployments are affected?
Salon booking system versions through 10.31.5 are affected. The available information does not identify a safe fixed version.
What does an attacker need to exploit this issue?
The issue is reflected XSS and is network-accessible with low attack complexity. It requires no attacker privileges, but it does require user interaction.
What is the likely impact if exploitation succeeds?
The reported CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation can affect a security scope beyond the vulnerable plugin.