{"id":"CVE-2026-124272","kind":"vulnerability","aliases":["CVE-2026-124272"],"related":[],"title":"Salon Booking System WordPress plugin: reflected XSS through 10.31.14","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.14.","summary":"The Salon Booking System plugin by Dimitri Grassi does not neutralize input in some pages, so a crafted link can inject script that runs in a visitor's browser. An attacker can use this to act as the victim on the affected site, such as stealing session data or changing content.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"salon-booking-system","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","salon-booking-system","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Salon Booking System plugin version in the WordPress admin plugins list; versions through `10.31.14` are listed as affected.","fix":"- Salon Booking System: unknown (sources do not name a fixed version)","status":"open","published_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:39+00:00","updated_at":"2026-11-13T15:48:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:39Z","model":"claude-haiku-5-5","output":{"fix":"- Salon Booking System: unknown (sources do not name a fixed version)","reach":"internet","title":"Salon Booking System WordPress plugin: reflected XSS through 10.31.14","impact":"medium","summary":"The Salon Booking System plugin by Dimitri Grassi does not neutralize input in some pages, so a crafted link can inject script that runs in a visitor's browser. An attacker can use this to act as the victim on the affected site, such as stealing session data or changing content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","salon-booking-system"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitor browsers, session data can be stolen","analyst_note":"Confirm the fixed version and whether auth is needed, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-124272 and the plugin's changelog.","how_to_check":"- Check the installed Salon Booking System plugin version in the WordPress admin plugins list; versions through `10.31.14` are listed as affected.\n- unknown","plain_action":"","product_name":"salon-booking-system","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Salon Booking System plugin through version 10.31.14 are affected, as the source lists the range from n/a through 10.31.14. Reflected XSS usually needs a victim to open a crafted link, so sites can reduce exposure by limiting the plugin until a fix is confirmed. unknown whether authentication or special settings are required.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4555,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124272':12A,15A '-2026':11A,14A '10.31.14':9A,111C 'act':61B 'affect':67B,104C 'allow':100C 'attack':56B 'book':2A,23B,28B,94C,98C,106C 'booking':18A 'browser':54B 'chang':75B 'content':76B 'craft':43B 'cross':86C 'cross-sit':85C 'cve':10A,13A 'data':73B 'dimitri':32B,91C 'generat':84C 'grassi':33B,92C 'improp':77C 'inject':46B 'input':37B,80C 'issu':103C 'link':44B 'n/a':109C 'neutral':36B,78C 'packag':20B 'page':40B,83C 'plugin':5A,30B 'reflect':6A,101C 'run':49B 'salon':1A,17A,22B,27B,93C,97C,105C 'salon-booking-system':16A,21B,96C 'script':47B,88C 'session':72B 'site':68B,87C 'steal':71B 'system':3A,19A,24B,29B,95C,99C,107C 'use':58B 'victim':64B 'visitor':52B 'vulner':89C 'web':82C 'wordpress':4A,25B 'xss':7A 'xss.this':102C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Salon Booking System plugin through version 10.31.14 are affected, as the source lists the range from n/a through 10.31.14. Reflected XSS usually needs a victim to open a crafted link, so sites can reduce exposure by limiting the plugin until a fix is confirmed. unknown whether authentication or special settings are required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["salonbookingsystem"],"ptokens":["booking","salon","system"],"labels":["high","package","salonbookingsystem","vendor","wordpress"],"campaign_type":null,"search_a":"'-124272':12A,15A '-2026':11A,14A '10.31.14':9A 'book':2A 'booking':18A 'cve':10A,13A 'plugin':5A 'reflect':6A 'salon':1A,17A 'salon-booking-system':16A 'system':3A,19A 'wordpress':4A 'xss':7A","search_b":"'act':61B 'affect':67B 'attack':56B 'book':23B,28B 'browser':54B 'chang':75B 'content':76B 'craft':43B 'data':73B 'dimitri':32B 'grassi':33B 'inject':46B 'input':37B 'link':44B 'neutral':36B 'packag':20B 'page':40B 'plugin':30B 'run':49B 'salon':22B,27B 'salon-booking-system':21B 'script':47B 'session':72B 'site':68B 'steal':71B 'system':24B,29B 'use':58B 'victim':64B 'visitor':52B 'wordpress':25B","search_c":"'10.31.14':111C 'affect':104C 'allow':100C 'book':94C,98C,106C 'cross':86C 'cross-sit':85C 'dimitri':91C 'generat':84C 'grassi':92C 'improp':77C 'input':80C 'issu':103C 'n/a':109C 'neutral':78C 'page':83C 'reflect':101C 'salon':93C,97C,105C 'salon-booking-system':96C 'script':88C 'site':87C 'system':95C,99C,107C 'vulner':89C 'web':82C 'xss.this':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124272","severity":null,"published_at":"2026-11-13T15:17:36+00:00","modified_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}