CVE-2026-109232: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wordpresschef Salon Booking System – Appointment Booking for Salons, Barbershops & Spas

CVE-2026-109232 is a stored cross-site scripting vulnerability in the Salon Booking System – Appointment Booking for Salons, Barbershops & Spas WordPress plugin. The issue exists in all versions up to and including 10.31.9 due to improper neutralization of input during web page generation, specifically via the 'sln[<checkout-field-key>]' parameter. This allows unauthenticated attackers to inject arbitrary web scripts that execute when users access the affected pages. Exploitation depends on the presence of at least one custom checkout field of type Html or File configured by the site administrator.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or conduct other malicious activities. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid configuring custom checkout fields of type Html or File. Monitor vendor communications for updates and apply patches promptly once released.