{"id":"CVE-2026-110033","kind":"vulnerability","aliases":["CVE-2026-110033"],"related":[],"title":"WordPress Salon Booking plugin: SSRF and stored SVG XSS by staff","description":"The Salon Booking System  WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.","summary":"The Salon Booking System WordPress plugin before 10.31.11 fetches a user-supplied image URL on the server without validation and saves the response publicly under an attacker-chosen filename. A user with the Salon Staff role or higher can use this to read internal-only resources and to store an SVG that runs scripts in the site's origin.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","salon-booking-system","self-hosted","wordpress"],"not_affected_if":["no-salon-staff-users","plugin-updated"],"how_to_check":"- Check the installed Salon Booking System plugin version in the WordPress admin Plugins screen, or with `wp plugin get salon-booking-system --field=version` (slug assumed; confirm it).\n- Review which users hold the Salon Staff role.","fix":"- Update the Salon Booking System plugin to `10.31.11` or later.\n- Until updated, restrict or remove the Salon Staff role from accounts that do not need it.","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:45:07+00:00","updated_at":"2026-10-25T03:45:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:45:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Salon Booking System plugin to `10.31.11` or later.\n- Until updated, restrict or remove the Salon Staff role from accounts that do not need it.","reach":"internet","title":"WordPress Salon Booking plugin: SSRF and stored SVG XSS by staff","impact":"medium","summary":"The Salon Booking System WordPress plugin before 10.31.11 fetches a user-supplied image URL on the server without validation and saves the response publicly under an attacker-chosen filename. A user with the Salon Staff role or higher can use this to read internal-only resources and to store an SVG that runs scripts in the site's origin.","category":"package","nicknames":[],"who_cares":["wordpress","salon-booking-system","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Staff can read internal server resources and host scripts that run on site visitors.","analyst_note":"","how_to_check":"- Check the installed Salon Booking System plugin version in the WordPress admin Plugins screen, or with `wp plugin get salon-booking-system --field=version` (slug assumed; confirm it).\n- Review which users hold the Salon Staff role.","needs_analyst":false,"not_affected_if":["plugin-updated","no-salon-staff-users"],"who_is_affected":"Sites running the Salon Booking System WordPress plugin before 10.31.11 that have users with the Salon Staff role or higher. The exposure depends on those users being able to reach the image-URL feature. Sites without the plugin, or with it already at 10.31.11 or later, are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3359,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110033':14A,17A '-2026':13A,16A '10.31.11':34B,96C 'access':119C 'allow':127C 'anyon':165C 'arbitrari':157C 'attack':55B,124C 'attacker-chosen':54B,123C 'book':3A,21B,29B,91C 'chosen':56B,125C 'cve':12A,15A 'disclos':147C 'fetch':35B,107C 'filenam':57B,126C 'forc':137C 'higher':66B,135C 'host':25B 'imag':40B,104C 'intern':73B,143C 'internal-on':72B,142C 'locat':120C 'malici':153C 'open':167C 'origin':88B,163C 'packag':18B 'plugin':4A,32B,94C 'public':51B,118C 'read':71B,141C 'resourc':75B,145C 'respons':50B,115C 'role':64B,133C 'run':82B,156C 'salon':2A,20B,28B,62B,90C,131C 'salon-booking-system':19B 'save':48B 'script':83B,158C 'self':24B 'self-host':23B 'server':44B,110C,139C 'server-sid':109C 'side':111C 'site':86B,161C 'ssrf':5A 'staff':11A,63B,132C 'store':7A,78B,151C 'suppli':39B,103C 'svg':8A,80B,154C 'system':22B,30B,92C 'url':41B,105C 'use':68B 'user':38B,59B,102C,128C 'user-suppli':37B,101C 'valid':46B,99C 'without':45B 'wordpress':1A,26B,31B,93C 'write':113C 'xss':9A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Salon Booking System WordPress plugin before 10.31.11 that have users with the Salon Staff role or higher. The exposure depends on those users being able to reach the image-URL feature. Sites without the plugin, or with it already at 10.31.11 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110033","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}