CVE-2026-109232 in Salon Booking System Plugin
Summary
by MITRE • 10/16/2026
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The Salon Booking System for WordPress represents a widely used solution designed to facilitate appointment scheduling within salons, barbershops, and spas. While these plugins provide essential functionality for business operations, they also introduce potential attack surfaces if not properly secured. A critical vulnerability has been identified in versions up to 10.31.9 of this plugin, specifically affecting the handling of custom checkout fields during the booking process. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, which poses significant risks to both site administrators and end-users who interact with the affected pages.
The technical root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin code. Specifically, the vulnerability exists in the processing of the sln[<checkout-field-key>] parameter. When a user submits data through a custom checkout field configured as type Html or File, the system fails to adequately validate or escape this input before storing it in the database. Consequently, malicious actors can inject arbitrary web scripts into these fields during the booking submission process. Because the plugin allows administrators to define such custom fields as part of its standard functionality, the attack vector is readily available without requiring any obscure configuration changes beyond default settings that enable HTML-based inputs.
The operational impact of this vulnerability is severe due to its stored nature. Unlike reflected XSS attacks where malicious scripts are executed only when a victim clicks on a specially crafted link, stored XSS persists in the application's database. This means that every time an administrator or any authorized user views the booking details containing the injected script, the code executes within their browser session under the context of the authenticated admin account. Attackers do not need to be unauthenticated to exploit this fully; while initial injection might occur via public-facing forms, the payload remains active until manually removed from the database. This persistence allows for prolonged access and potential data theft or defacement without further interaction from the attacker after the initial setup.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack methodology corresponds to ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution within web browsers. By leveraging the trusted context of an administrative session, attackers can perform actions such as stealing cookies or session tokens, redirecting users to phishing sites, or modifying page content to deceive other visitors. The requirement that at least one custom checkout field be set to Html or File type does not mitigate the risk but rather defines the specific configuration state under which exploitation is possible, making it a relevant consideration for site owners who utilize these features.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary defense is upgrading the Salon Booking System plugin to version 10.32.0 or later, where developers have implemented proper input validation and output encoding procedures. Until an update can be applied, administrators should consider disabling custom checkout fields of type Html or File if they are not strictly necessary for business operations. Additionally, implementing a Web Application Firewall (WAF) with rules tuned to detect XSS payloads in form submissions can provide an additional layer of defense by blocking malicious requests before they reach the application logic. Regular security audits and code reviews focusing on data handling practices will help prevent similar vulnerabilities from being introduced in future updates or custom modifications.