Live › vulnerability › CVE-2026-110033
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.11 fetches a user-supplied image URL on the server without validation and saves the response publicly under an attacker-chosen filename. A user with the Salon Staff role or higher can use this to read internal-only resources and to store an SVG that runs scripts in the site's origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Salon Booking System WordPress plugin before 10.31.11 that have users with the Salon Staff role or higher. The exposure depends on those users being able to reach the image-URL feature. Sites without the plugin, or with it already at 10.31.11 or later, are not affected.
No product ranges from the sources yet.
wp plugin get salon-booking-system --field=version (slug assumed; confirm it).10.31.11 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.
This page as .md · .json · in your agent: get_signal("CVE-2026-110033")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.