# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas

> Appointment booking built only for salons, barbershops and spas. Set it up in minutes by chatting with the AI assistant.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:35 UTC.

## Facts (WordPress.org)

- Slug: `salon-booking-system`
- Author: Dimitri Grassi
- Version: 10.31.15
- Active installs: 2,000+
- Last update: 2026-11-07 (6 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.0, PHP 7.4.8
- Tags: appointment booking, barber, beauty salon, hairdresser, salon
- Page: https://wordpress.org/plugins/salon-booking-system/

## Checks (against WordPress 7.1.4)

- OK: Updated 6 days ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 7.4.8 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-10-19 MEDIUM: Unauthenticated Negative Booking Total Creation (up to 10.31.10). CVE-2026-110034, https://www.wordfence.com/threat-intel/vulnerabilities/id/0098157e-c3e8-42e4-bd79-c9f2ea26f4db?source=api-prod
- 2026-10-18 HIGH: Authenticated (Salon Staff+) Privilege Escalation (10.17 to 10.31.10). CVE-2026-110031, https://www.wordfence.com/threat-intel/vulnerabilities/id/5483b895-2019-408f-8af1-4a5c9af6c388?source=api-prod
- 2026-10-18 MEDIUM: Missing Authorization (up to 10.31.10). CVE-2026-110032, https://www.wordfence.com/threat-intel/vulnerabilities/id/0945e251-9044-4c04-869d-c6ffb6368cc3?source=api-prod
- 2026-10-18 MEDIUM: Authenticated (Salon Staff+) Stored Cross-Site Scripting (up to 10.31.10). CVE-2026-110033, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1ba486-095a-482a-adbe-e51b140b2db7?source=api-prod
- 2026-10-18 MEDIUM: Missing Authorization (up to 10.31.10). CVE-2026-110035, https://www.wordfence.com/threat-intel/vulnerabilities/id/eb19296a-6439-4c3f-be41-d06ccf7ca1fa?source=api-prod
- 2026-10-16 HIGH: Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX (up to 10.31.9). CVE-2026-109232, https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=api-prod
- 2026-10-16 MEDIUM: Authenticated (Subscriber+) Information Exposure (up to 10.31.2). CVE-2026-110012, https://www.wordfence.com/threat-intel/vulnerabilities/id/15dedb2b-b96d-4d05-a8c9-cf414321f6a2?source=api-prod
- 2026-10-16 MEDIUM: Insufficient Authorization to Booking API Access (up to 10.31.8). CVE-2026-110013, https://www.wordfence.com/threat-intel/vulnerabilities/id/92feef8c-61dc-4e96-9fca-e87e35c9d584?source=api-prod
- 2026-10-16 MEDIUM: Missing Authorization (up to 10.31.8). CVE-2026-110014, https://www.wordfence.com/threat-intel/vulnerabilities/id/bdfc1f2c-ee3b-4c62-854f-2ab153c2496d?source=api-prod
- 2026-10-16 MEDIUM: Cross-Site Request Forgery (up to 10.31.8). CVE-2026-110015, https://www.wordfence.com/threat-intel/vulnerabilities/id/f582457e-5182-405c-b6c0-7d90241247ce?source=api-prod
- 2026-10-09 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 10.31.5). CVE-2026-94668, https://www.wordfence.com/threat-intel/vulnerabilities/id/a4573514-d56d-4b23-a844-d0ca003d10e6?source=api-prod
- 2026-10-06 HIGH: Unauthenticated Privilege Escalation (up to 10.31.7). CVE-2026-105070, https://www.wordfence.com/threat-intel/vulnerabilities/id/3dcc974f-6208-4362-bdf3-c5d4b5fc1ef5?source=api-prod
- 2026-09-10 MEDIUM: Missing Authorization (up to 10.31.5). CVE-2026-81793, https://www.wordfence.com/threat-intel/vulnerabilities/id/12c9dc6c-22ed-4f60-a85c-83b660e69544?source=api-prod
- 2026-08-13 MEDIUM: Missing Authorization (up to 10.30.26). CVE-2026-66453, https://www.wordfence.com/threat-intel/vulnerabilities/id/505043c9-1373-4bb0-8b52-1614b0cf1f8a?source=api-prod
- 2026-08-10 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure (before 10.31.3). CVE-2026-17020, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9691ccf-269e-4154-b524-8587644fde24?source=api-prod
- 2026-08-10 MEDIUM: Missing Authorization (up to 10.30.33). CVE-2026-17021, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1715959-532a-4dd7-b384-0bd5f2673e2b?source=api-prod
- 2026-08-10 MEDIUM: Unauthenticated Booking Information Disclosure (up to 10.30.33). CVE-2026-17022, https://www.wordfence.com/threat-intel/vulnerabilities/id/97b9cfa8-0bb4-47ac-b811-514c0d76d8ef?source=api-prod
- 2026-08-10 MEDIUM: Missing Authorization to Unauthenticated Google Calendar Connection Hijack (before 10.31.3). CVE-2026-17023, https://www.wordfence.com/threat-intel/vulnerabilities/id/2950465d-a030-4003-8751-c93e3a678eb1?source=api-prod
- 2026-07-10 HIGH: Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter (up to 10.30.32). CVE-2026-15070, https://www.wordfence.com/threat-intel/vulnerabilities/id/301ad19a-f99c-45c8-83a7-d74e1a260556?source=api-prod
- 2026-07-01 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass (up to 10.30.19). CVE-2026-11887, https://www.wordfence.com/threat-intel/vulnerabilities/id/88089d8e-9040-482d-b0e5-d2412885f390?source=api-prod
- 2026-06-17 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 10.30.24). CVE-2026-40768, https://www.wordfence.com/threat-intel/vulnerabilities/id/94fc7e20-0fd1-4a10-b821-e5aba4512f3f?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 10.30.25). CVE-2026-42666, https://www.wordfence.com/threat-intel/vulnerabilities/id/98719f12-d100-4f72-a8fa-61205a24784d?source=api-prod
- 2026-05-02 HIGH: Unauthenticated Arbitrary File Read via Booking File Field Path Traversal (up to 10.30.25). CVE-2026-6320, https://www.wordfence.com/threat-intel/vulnerabilities/id/e91b8082-e1c7-4989-82db-20e255b52854?source=api-prod
- 2026-01-21 LOW: Authenticated (Subscriber+) Information Exposure (up to 10.30.3). CVE-2025-67954, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb0b2e1c-52f2-4f33-9011-e29fd042cf2c?source=api-prod
- 2025-12-07 MEDIUM: Cross-Site Request Forgery (up to 10.30.3). CVE-2025-66531, https://www.wordfence.com/threat-intel/vulnerabilities/id/f89aeafd-3449-46b0-b350-bb3b7b08a47d?source=api-prod
- 2025-09-10 MEDIUM: Missing Authorization to Unauthenticated AJAX Actions Execution (up to 10.22). CVE-2025-8492, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a63a4ec-80e6-48cc-a778-97fa3917817e?source=api-prod
- 2025-05-15 MEDIUM: Cross-Site Request Forgery to Arbitrary Post/Page Deletion (up to 10.16). CVE-2025-47583, https://www.wordfence.com/threat-intel/vulnerabilities/id/91a2fa6e-f434-4b56-af68-71e1ee565cc8?source=api-prod
- 2025-04-04 MEDIUM: Missing Authorization (up to 10.29.6). CVE-2025-32220, https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f291e0-6c99-43d8-830a-1ff90b496b18?source=api-prod
- 2025-04-01 HIGH: Authenticated Privilege Escalation (up to 10.11). CVE-2025-31560, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f119b98-9c42-40e2-b4f3-c26bed3cc213?source=api-prod
- 2024-09-25 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 10.9). CVE-2024-47316, https://www.wordfence.com/threat-intel/vulnerabilities/id/6c8b8b0a-2d84-499b-8646-0a84e47620e7?source=api-prod
- 2024-09-13 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 10.9.3). CVE-2024-9882, https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb3c416-10d2-48b1-a158-74613be2fd21?source=api-prod
- 2024-08-16 MEDIUM: Unauthenticated Open Redirect (up to 10.8.1). CVE-2024-43280, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8e64950-4f01-4391-8c65-2f25ff5bcc06?source=api-prod
- 2024-08-01 CRITICAL: Authenticated (Administrator+) SQL Injection (up to 10.7). CVE-2024-39658, https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b74a84-e418-4bd4-b36e-5bd4ba5197c9?source=api-prod
- 2024-06-24 HIGH: Path Traversal (up to 9.9). CVE-2024-37231, https://patchstack.com/database/vulnerability/salon-booking-system/wordpress-salon-booking-system-plugin-9-9-arbitrary-file-deletion-vulnerability?_s_id=cve
- 2024-06-18 CRITICAL: Unauthenticated Arbitrary File Upload (up to 10.2). CVE-2024-3229, https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=api-prod
- 2024-06-07 MEDIUM: Missing Authorization (up to 9.9). CVE-2024-4468, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b73f864-68b5-4ba8-93a3-37f2564cc240?source=api-prod
- 2024-05-17 CRITICAL: Unauthenticated Arbitrary File Deletion (up to 9.9). CVE-2024-4442, https://www.wordfence.com/threat-intel/vulnerabilities/id/eaafeadd-f44c-49b1-b900-ef40800c629e?source=api-prod
- 2024-04-26 MEDIUM: Cross-Site Request Forgery to Settings Update (up to 9.6.5). CVE-2024-2429, https://www.wordfence.com/threat-intel/vulnerabilities/id/abf1ace3-e066-4f28-9f37-3e9fa79aef7d?source=api-prod
- 2024-04-05 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings (up to 9.6.5). CVE-2024-2603, https://www.wordfence.com/threat-intel/vulnerabilities/id/45ddf224-b359-45ec-97a0-5a3257f56420?source=api-prod
- 2024-04-05 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting (up to 9.6.5). CVE-2024-2439, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c837b9-c205-4fdc-8305-b9387dedd581?source=api-prod
- 2024-03-28 CRITICAL: Unauthenticated Arbitrary File Upload (up to 9.5). CVE-2024-30510, https://www.wordfence.com/threat-intel/vulnerabilities/id/929fd4e6-9040-41cb-98f0-0cfdd80caf42?source=api-prod
- 2024-03-27 HIGH: Unauthenticated Stored Cross-Site Scripting via 'sms_prefix' (up to 9.6.2). CVE-2024-2102, https://www.wordfence.com/threat-intel/vulnerabilities/id/32c4cb55-855c-42ed-a9ac-90f92e8583e0?source=api-prod
- 2024-03-27 MEDIUM: Authenticated (Customer+) Stored Cross-Site Scripting (up to 9.6.2). CVE-2024-2101, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd6c6f7-a535-4e3a-8d72-01007d00d6be?source=api-prod
- 2023-11-23 HIGH: Authenticated (Editor+) Privilege Escalation (before 8.7). CVE-2023-48319, https://www.wordfence.com/threat-intel/vulnerabilities/id/0cac7f96-eb64-427d-9a95-b8bf1c675af0?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (up to 8.4.8). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e-243, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2023-06-27 MEDIUM: Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer (up to 8.4.7). CVE-2023-3427, https://www.wordfence.com/threat-intel/vulnerabilities/id/93875f19-d9b9-4e33-bba9-afc75cf26bf2?source=api-prod
- 2022-11-08 MEDIUM: Reflected Cross-Site Scripting (up to 7.9). CVE-2022-43487, https://www.wordfence.com/threat-intel/vulnerabilities/id/8eb778d0-2aa4-4d0a-9ac1-42af51c335bf?source=api-prod
- 2022-03-21 MEDIUM: Sensitive Data Disclosure (up to 7.6.2). CVE-2022-0919, https://www.wordfence.com/threat-intel/vulnerabilities/id/a82ac1c9-e037-4afa-b433-2efef2e61403?source=api-prod
- 2022-03-21 HIGH: Sensitive Information Disclosure (up to 7.6.2). CVE-2022-0920, https://www.wordfence.com/threat-intel/vulnerabilities/id/d830b73c-0666-4632-8001-fe2c467a37a0?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 7.6.3). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42-145, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod
- 2021-06-21 MEDIUM: Stored Cross-Site Scripting (before 6.3.1). CVE-2021-24429, https://www.wordfence.com/threat-intel/vulnerabilities/id/13657ad7-7185-4be2-98e2-aeaf8514ad4d?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=salon-booking-system · HTML: https://todaywp.com/plugins/salon-booking-system