WordPress salon-booking-system has 13 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-0920 | The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could | high | 7.5 | <7.6.3 | 7.6.3 |
| CVE-2021-24429 | The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointmen | medium | 6.1 | <6.3.1 | 6.3.1 |
| CVE-2024-4442 | The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is du | critical | 9.1 | <10.0 | 10.0 |
| CVE-2022-0919 | The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any | medium | 5.3 | <7.6.3 | 7.6.3 |
| CVE-2024-3229 | The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_ | critical | 9.8 | <10.3 | 10.3 |
| CVE-2024-2101 | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appoin | medium | 5.7 | <9.6.3 | 9.6.3 |
| CVE-2024-2603 | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 6.3 | <9.6.6 | 9.6.6 |
| CVE-2024-2102 | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' param | medium | 4.7 | <9.6.3 | 9.6.3 |
| CVE-2024-2439 | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege | medium | 4.8 | <9.6.6 | 9.6.6 |
| CVE-2024-4468 | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability chec | medium | 4.3 | <10.0 | 10.0 |
| CVE-2023-3427 | The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is d | medium | 5.4 | <=8.4.6 | – |
| CVE-2024-9882 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and esc | medium | 4.8 | <1.9.4 | 1.9.4 |
| CVE-2024-2429 | The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow atta | medium | 4.3 | <9.6.6 | 9.6.6 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked