WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
salon-booking-system
Published
2026-08-06
Title
Salon Booking System – Free Version < 10.31.3 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
Slug
salon-booking-system
Published
2026-08-07
Title
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas < 10.30.27 - Missing Authorization
Slug
salon-booking-system
Published
2026-09-08
Title
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Missing Authorization
Slug
salon-booking-system
Published
2026-10-05
Title
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas < 10.31.9 - Unauthenticated Privilege Escalation
Slug
salon-booking-system
Published
2026-10-04
Title
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas < 10.31.6 - Unauthenticated Stored Cross-Site Scripting
Slug
salon-booking-system
Published
2026-10-14
Title
Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
Slug
salon-booking-system
Published
2026-10-14
Title
Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
Slug
salon-booking-system
Published
2026-10-14
Title
Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
Slug
salon-booking-system
Published
2026-10-14
Title
Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
Slug
salon-booking-system
Published
2026-10-15
Title
Salon Booking System < 10.31.10 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
Slug
salon-booking-system
Published
2026-10-16
Title
Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
Slug
salon-booking-system
Published
2026-10-16
Title
Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route
Slug
salon-booking-system
Published
2026-10-16
Title
Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'
Slug
salon-booking-system
Published
2026-10-16
Title
Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
Slug
salon-booking-system
Published
2026-10-16
Title
Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor
Slug
salt-shaker
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
salvador-ai-image-generator
Published
2025-01-16
Title
Salvador – AI Image Generator <= 1.0.11 - Missing Authorization
Slug
sam-pro-free
Published
2016-10-28
Title
SAM Pro (Free Edition) < 1.9.7.69 - Local File Inclusion (LFI)
Slug
samandehi-logo-manager
Published
2025-06-19
Title
Logo Manager For Samandehi <= 0.5 - Cross-Site Request Forgery
Slug
same-but-different
Published
2025-01-06
Title
Same but Different – Related Posts by Taxonomy <= 1.0.16 - Reflected Cross-Site Scripting
Slug
same-category-posts
Published
2026-01-23
Title
Same Category Posts < 1.1.20 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholder
Slug
samo-forms
Published
2026-09-10
Title
SAMO Forms <= 1.0.0 - Unauthenticated SQLi
Slug
sandbox
Published
2025-01-16
Title
Sandbox <= 0.4 - Reflected Cross-Site Scripting
Slug
sandbox
Published
2025-01-16
Title
Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download
Slug
sangar-slider-lite
Published
2024-04-11
Title
Sangar Slider <= 1.3.2 - Cross-Site Request Forgery