Stored Cross-Site Scripting in Salon Booking System Plugin

The Salon Booking System - Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'sln[<checkout-field-key>]' parameter. This vulnerability affects all versions up to and including 10.31.9. The flaw exists due to insufficient input sanitization and output escaping of user-provided data within custom checkout fields. An unauthenticated attacker can exploit this by injecting arbitrary web scripts into pages that utilize these fields. Successful exploitation occurs when a site administrator has configured at least one custom checkout field of type Html or File. When a user subsequently accesses the affected page, the injected script executes in the user's browser context, potentially allowing session hijacking, unauthorized actions, or further compromise of the victim's interaction with the site.

Impact

The vulnerability poses a significant risk to WordPress sites utilizing the affected plugin for booking management. Successful exploitation allows for the execution of arbitrary JavaScript in the context of site users or administrators. This could lead to the theft of session cookies, administrative account takeover, or redirection of users to malicious third-party sites. Given the plugin's function as a booking system, high-traffic sites managing customer data are primary targets.

Recommendation

• Immediately update the Salon Booking System - Appointment Booking for Salons, Barbershops & Spas plugin to a version beyond 10.31.9, once a patch is available.
• Audit existing custom checkout fields configured within the plugin to identify and remove any suspicious content or unexpected scripts.
• Implement or strengthen Content Security Policy (CSP) headers on WordPress sites to mitigate the impact of injected malicious scripts.
• Monitor web access logs for anomalous POST requests directed at plugin-specific booking endpoints that contain script-like characters or payloads.