CVE-2026-110033: CWE-79 Cross-Site Scripting (XSS) in Salon Booking System

CVE-2026-110033 is a cross-site scripting (XSS) vulnerability in the Salon Booking System WordPress plugin versions prior to 10.31.11. The flaw arises because the plugin fails to validate user-supplied image URLs before fetching them server-side and saving the response under an attacker-chosen filename in a publicly accessible location. This enables users with the Salon Staff role or higher to force the server to read internal-only resources, potentially disclosing sensitive information. Furthermore, attackers can upload malicious SVG files that execute arbitrary scripts in the context of the site's origin, leading to XSS attacks against site visitors.

Users with the Salon Staff role or higher can exploit this vulnerability to access internal server resources that should not be publicly accessible, leading to potential information disclosure. Additionally, the ability to store malicious SVG files that execute scripts can result in cross-site scripting attacks affecting any user who views the malicious content, potentially compromising user sessions or performing unauthorized actions within the site's origin.

A fix is available in Salon Booking System plugin version 10.31.11. Users should upgrade to version 10.31.11 or later to remediate this vulnerability. No vendor advisory was provided, so patch status is inferred from the version information. Until patched, restrict Salon Staff role permissions if possible to limit exposure.