Salon Booking System
Salon Booking System Security Releases - October 2026
salon-booking-system-2026-10 Oct 1, 2026 Source: Vendor
Salon Booking System security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-110012
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2026-110012
BR2026-0000-034057
Salon Booking System
unclaimed
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as ...
Credited as Andy Urlep
CVE-2026-110013
BR2026-0000-034058
Salon Booking System
unclaimed
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Book...
Credited as vuxvinh
CVE-2026-110014
BR2026-0000-034059
Salon Booking System
unclaimed
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing u...
Credited as Raphael P. Cigana
CVE-2026-110015
BR2026-0000-034060
Salon Booking System
unclaimed
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions...
Credited as Raphael P. Cigana