{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/salon-booking-system--appointment-booking-for-salons-barbershops--spas--10.31.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109232"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Salon Booking System – Appointment Booking for Salons, Barbershops \u0026 Spas (\u003c= 10.31.9)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","wordpress","cve-2026-109232"],"_cs_type":"advisory","_cs_vendors":["Salon Booking System"],"content_html":"\u003cp\u003eThe Salon Booking System - Appointment Booking for Salons, Barbershops \u0026amp; Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'sln[\u0026lt;checkout-field-key\u0026gt;]' parameter. This vulnerability affects all versions up to and including 10.31.9. The flaw exists due to insufficient input sanitization and output escaping of user-provided data within custom checkout fields. An unauthenticated attacker can exploit this by injecting arbitrary web scripts into pages that utilize these fields. Successful exploitation occurs when a site administrator has configured at least one custom checkout field of type Html or File. When a user subsequently accesses the affected page, the injected script executes in the user's browser context, potentially allowing session hijacking, unauthorized actions, or further compromise of the victim's interaction with the site.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a significant risk to WordPress sites utilizing the affected plugin for booking management. Successful exploitation allows for the execution of arbitrary JavaScript in the context of site users or administrators. This could lead to the theft of session cookies, administrative account takeover, or redirection of users to malicious third-party sites. Given the plugin's function as a booking system, high-traffic sites managing customer data are primary targets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Salon Booking System - Appointment Booking for Salons, Barbershops \u0026amp; Spas plugin to a version beyond 10.31.9, once a patch is available.\u003c/li\u003e\n\u003cli\u003eAudit existing custom checkout fields configured within the plugin to identify and remove any suspicious content or unexpected scripts.\u003c/li\u003e\n\u003cli\u003eImplement or strengthen Content Security Policy (CSP) headers on WordPress sites to mitigate the impact of injected malicious scripts.\u003c/li\u003e\n\u003cli\u003eMonitor web access logs for anomalous POST requests directed at plugin-specific booking endpoints that contain script-like characters or payloads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:26:47Z","date_published":"2026-10-16T06:26:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-salon-booking-xss/","summary":"An unauthenticated Stored XSS vulnerability in the Salon Booking System WordPress plugin allows attackers to inject malicious scripts into checkout fields.","title":"Stored Cross-Site Scripting in Salon Booking System Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-salon-booking-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Salon Booking System – Appointment Booking for Salons, Barbershops \u0026 Spas (\u003c= 10.31.9)","version":"https://jsonfeed.org/version/1.1"}