{"items":[{"id":"CVE-2026-109232","published":"2026-10-16T05:30:24.038Z","updated":"2026-10-16T14:39:04.204Z","title":"Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX","severity":"HIGH","score":7.2,"vendor":"wordpresschef","product":"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-15070","published":"2026-07-10T03:31:12.552Z","updated":"2026-07-10T15:24:41.007Z","title":"Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter","severity":"HIGH","score":8.8,"vendor":"wordpresschef","product":"Salon Booking System – Free Version","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-6320","published":"2026-05-02T11:16:11.330Z","updated":"2026-05-04T15:37:04.821Z","title":"Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal","severity":"HIGH","score":7.5,"vendor":"wordpresschef","product":"Salon Booking System – Free Version","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-25334","published":"2026-03-25T16:14:41.531Z","updated":"2026-04-28T16:14:55.647Z","title":"WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability","severity":"HIGH","score":8.1,"vendor":"wordpresschef","product":"Salon Booking System Pro","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2025-8492","published":"2025-09-11T07:24:56.874Z","updated":"2026-04-08T17:11:03.500Z","title":"Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution","severity":"MEDIUM","score":5.3,"vendor":"wordpresschef","product":"Salon Booking System – Free Version","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2025-32295","published":"2025-05-16T15:45:31.498Z","updated":"2026-04-28T16:12:21.623Z","title":"WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability","severity":"MEDIUM","score":4.3,"vendor":"wordpresschef","product":"Salon Booking Pro","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2022-4974","published":"2024-10-16T06:43:30.014Z","updated":"2026-04-08T16:46:54.861Z","title":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","severity":"MEDIUM","score":6.3,"vendor":"dashlabsltd","product":"YASR – Yet Another Star Rating Plugin for WordPress","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2024-3229","published":"2024-06-19T04:31:58.762Z","updated":"2026-04-08T16:47:16.503Z","title":"Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload","severity":"CRITICAL","score":9.8,"vendor":"wordpresschef","product":"Salon Booking System – Free Version","kev":false,"epss":0.00854,"kevAdded":null},{"id":"CVE-2024-4468","published":"2024-06-08T07:37:38.584Z","updated":"2026-04-08T17:05:50.048Z","title":"Salon booking system <= 9.9 - Missing Authorization","severity":"MEDIUM","score":4.3,"vendor":"wordpresschef","product":"Salon Booking System – Free Version","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2024-4442","published":"2024-05-21T06:49:55.436Z","updated":"2026-04-08T17:31:03.779Z","title":"Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion","severity":"CRITICAL","score":9.1,"vendor":"wordpresschef","product":"Salon Booking System – Free Version","kev":false,"epss":0.01236,"kevAdded":null},{"id":"CVE-2023-3427","published":"2023-06-28T01:48:22.850Z","updated":"2026-04-08T17:09:41.283Z","title":"Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer","severity":"MEDIUM","score":5.4,"vendor":"wordpresschef","product":"Salon Booking System – Free Version","kev":false,"epss":0.00296,"kevAdded":null}]}