Plugin security history

Salon Booking System – Free Version Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Salon Booking System – Free Version, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records

4Critical

6High

20Medium

1Low

0Informational

30Patched records

1Currently marked unpatched

2021-06-21First disclosure

2026-07-09Latest disclosure

31 of 31CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2022	4	4 records
2023	3	3 records
2024	13	13 records
2025	5	5 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	4	12.9%
High	6	19.4%
Medium	20	64.5%
Low	1	3.2%

Vulnerability-Type Breakdown

Missing Authorization

9 records29%

First: 2022. Latest: 2026.

Cross-Site Scripting

8 records25.8%

First: 2021. Latest: 2024.

CSRF

5 records16.1%

First: 2023. Latest: 2026.

Privilege Escalation

2 records6.5%

First: 2023. Latest: 2025.

Arbitrary File Upload

2 records6.5%

First: 2024. Latest: 2024.

Path Traversal

2 records6.5%

First: 2024. Latest: 2026.

SQL Injection

1 record3.2%

First: 2024. Latest: 2024.

Other

1 record3.2%

First: 2024. Latest: 2024.

Information Disclosure

1 record3.2%

First: 2026. Latest: 2026.

Patch Status

Patched: 30
Currently marked unpatched: 1
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

10.30.33
10.30.26
10.30.25
10.30.4
10.24
10.17
10.15
10.9.1
10.9.4
10.9
10.8
10.3
10.0
9.6.6
9.5.1
9.6.3
8.7
8.4.9
8.4.8
7.9.4
7.6.3
6.3.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-10.30.32`	Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter	July 9, 2026	10.30.33	High
`*-10.30.25`	Salon Booking System – Free Version <= 10.30.25 - Missing Authorization	May 10, 2026	10.30.26	Medium
`*-10.30.25`	Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal	May 1, 2026	10.30.26	High
`*-10.30.24`	Salon Booking System – Free Version <= 10.30.24 - Unauthenticated Insecure Direct Object Reference	April 21, 2026	10.30.25	Medium
`*-10.30.3`	Salon booking system <= 10.30.3 - Authenticated (Subscriber+) Information Exposure	January 21, 2026	10.30.4	Low
`*-10.30.3`	Salon booking system <= 10.30.3 - Cross-Site Request Forgery	December 7, 2025	10.30.4	Medium
`*-10.22`	Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution	September 10, 2025	10.24	Medium
`*-10.16`	Salon booking system <= 10.16 - Cross-Site Request Forgery to Arbitrary Post/Page Deletion	May 15, 2025	10.17	Medium
`*-10.29.6`	Salon booking system <= 10.29.6 - Missing Authorization	April 4, 2025	Not supplied	Medium
`*-10.11`	Salon booking system <= 10.11 - Authenticated Privilege Escalation	April 1, 2025	10.15	High
`*-10.9`	Salon booking system <= 10.9 - Authenticated (Subscriber+) Insecure Direct Object Reference	September 25, 2024	10.9.1	Medium
`*-10.9.3`	Salon Booking System <= 10.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	September 13, 2024	10.9.4	Medium
`*-10.8.1`	Salon booking system <= 10.8.1 - Unauthenticated Open Redirect	August 16, 2024	10.9	Medium
`*-10.7`	Salon booking system <= 10.7 - Authenticated (Administrator+) SQL Injection	August 1, 2024	10.8	Critical
`*-10.2`	Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload	June 18, 2024	10.3	Critical
`*-9.9`	Salon booking system <= 9.9 - Missing Authorization	June 7, 2024	10.0	Medium
`*-9.9`	Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion	May 17, 2024	10.0	Critical
`*-9.6.5`	Salon booking system <= 9.6.5 - Cross-Site Request Forgery to Settings Update	April 26, 2024	9.6.6	Medium
`*-9.6.5`	Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting	April 5, 2024	9.6.6	Medium
`*-9.6.5`	Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings	April 5, 2024	9.6.6	Medium
`*-9.5`	Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload	March 28, 2024	9.5.1	Critical
`*-9.6.2`	Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting	March 27, 2024	9.6.3	Medium
`*-9.6.2`	Salon booking system <= 9.6.2 - Unauthenticated Stored Cross-Site Scripting via 'sms_prefix'	March 27, 2024	9.6.3	High
`[*, 8.7)`	Salon booking system < 8.7 - Authenticated (Editor+) Privilege Escalation	November 23, 2023	8.7	High
`*-8.4.8`	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	July 18, 2023	8.4.9	Medium

Selected source records

Latest Records

HighCVE-2026-15070

Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter

Published: July 9, 2026

Affected versions: *-10.30.32
Patched versions: 10.30.33

Original Wordfence record

MediumCVE-2026-42666

Salon Booking System – Free Version <= 10.30.25 - Missing Authorization

Published: May 10, 2026

Affected versions: *-10.30.25
Patched versions: 10.30.26

Original Wordfence record

HighCVE-2026-6320

Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal

Published: May 1, 2026

Affected versions: *-10.30.25
Patched versions: 10.30.26

Original Wordfence record

MediumCVE-2026-40768

Salon Booking System – Free Version <= 10.30.24 - Unauthenticated Insecure Direct Object Reference

Published: April 21, 2026

Affected versions: *-10.30.24
Patched versions: 10.30.25

Original Wordfence record

LowCVE-2025-67954

Salon booking system <= 10.30.3 - Authenticated (Subscriber+) Information Exposure

Published: January 21, 2026

Affected versions: *-10.30.3
Patched versions: 10.30.4

Original Wordfence record

MediumCVE-2025-66531

Salon booking system <= 10.30.3 - Cross-Site Request Forgery

Published: December 7, 2025

Affected versions: *-10.30.3
Patched versions: 10.30.4

Original Wordfence record

MediumCVE-2025-8492

Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution

Published: September 10, 2025

Affected versions: *-10.22
Patched versions: 10.24

Original Wordfence record

MediumCVE-2025-47583

Salon booking system <= 10.16 - Cross-Site Request Forgery to Arbitrary Post/Page Deletion

Published: May 15, 2025

Affected versions: *-10.16
Patched versions: 10.17

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-30510

Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload

Published: March 28, 2024

Affected versions: *-9.5
Patched versions: 9.5.1

Original Wordfence record

CriticalCVE-2024-3229

Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload

Published: June 18, 2024

Affected versions: *-10.2
Patched versions: 10.3

Original Wordfence record

CriticalCVE-2024-39658

Salon booking system <= 10.7 - Authenticated (Administrator+) SQL Injection

Published: August 1, 2024

Affected versions: *-10.7
Patched versions: 10.8

Original Wordfence record

CriticalCVE-2024-4442

Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion

Published: May 17, 2024

Affected versions: *-9.9
Patched versions: 10.0

Original Wordfence record

HighCVE-2026-15070

Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter

Published: July 9, 2026

Affected versions: *-10.30.32
Patched versions: 10.30.33

Original Wordfence record

HighCVE-2025-31560

Salon booking system <= 10.11 - Authenticated Privilege Escalation

Published: April 1, 2025

Affected versions: *-10.11
Patched versions: 10.15

Original Wordfence record

HighCVE-2022-0920

Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Information Disclosure

Published: March 21, 2022

Affected versions: *-7.6.2
Patched versions: 7.6.3

Original Wordfence record

HighCVE-2026-6320

Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal

Published: May 1, 2026

Affected versions: *-10.30.25
Patched versions: 10.30.26

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-32220

Salon booking system <= 10.29.6 - Missing Authorization

Published: April 4, 2025

Affected versions: *-10.29.6
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory