Vulnerability · Published Oct 18, 2026 · Assigned by WPScan

CVE-2026-110033Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'

Medium 6.8

In plain English

A medium-severity cross-site scripting in Salon Booking System from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Salon Booking System	0 – before 10.31.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/6c8f3d74-7aa6-4b4e-96d0-ee89fc47a255/ exploit, vdb-entry, technical-description