blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24429

MEDIUM 6.1 CVSS 3.1
Published
July 12, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.

Affected WordPress components

  • Salon Booking System – Appointment Booking for Salons, Barbershops & Spas Plugin · salon-booking-system
    Confirmed match Active
    From 6.3.1 (including) to 6.3.1 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Salon Booking System Salon booking system — From 6.3.1 (including) to 6.3.1 (excluding)
  • salonbookingsystem salon_booking_system — Before 6.3.1

References

  • wpscan.com https://wpscan.com/vulnerability/e922b788-7da5-43b4-9b05-839c8610252a Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record