CVE-2026-110033: Salon Booking System XSS Vulnerability

CVE-2026-110033 Overview

CVE-2026-110033 affects the Salon Booking System WordPress plugin in versions prior to 10.31.11. The plugin fails to validate user-supplied image URLs before fetching them server-side and writing the responses to a publicly accessible location under an attacker-chosen filename. Authenticated users with the Salon Staff role or higher can abuse this to force the server to read internal-only resources and to store malicious Scalable Vector Graphics (SVG) files that execute arbitrary scripts in the site origin. The flaw combines Server-Side Request Forgery (SSRF) with stored Cross-Site Scripting (XSS) [CWE-79].

Critical Impact
Authenticated staff-level users can read internal network resources and stage SVG payloads that execute JavaScript in the context of any visitor who opens them.

Affected Products

Salon Booking System WordPress plugin versions before 10.31.11
WordPress sites assigning the Salon Staff role to untrusted users
Any WordPress deployment with the vulnerable plugin accessible from the network

Discovery Timeline

2026-10-18 - CVE-2026-110033 published to the National Vulnerability Database (NVD)
2026-10-19 - CVE-2026-110033 record last updated in NVD

Technical Details for CVE-2026-110033

Vulnerability Analysis

The plugin exposes a feature that accepts an image URL from an authenticated user and retrieves the content server-side. The fetched response is written to a web-accessible directory using a filename supplied by the requester. No validation is performed on the URL scheme, destination host, response content type, or output filename. This design permits two distinct abuses from the same code path: cross-origin internal fetches and arbitrary file placement with attacker-controlled extensions.

Because the write occurs under a public path, the stored object becomes retrievable by any unauthenticated visitor. The attacker-controlled filename allows selection of extensions such as .svg, which browsers render inline and parse for embedded scripts. The combination converts a server-side fetch primitive into a persistent script-injection vector in the site's origin.

Root Cause

The root cause is missing input validation on the image URL parameter and the output filename. The handler neither constrains outbound requests to safe destinations nor enforces a content-type allowlist, nor sanitizes SVG payloads before writing them. User-supplied values flow directly into both the HTTP client and the file write operation.

Attack Vector

An attacker authenticated as Salon Staff or higher submits an image URL pointing to an internal resource, such as a cloud metadata endpoint or an intranet service. The plugin fetches the resource and writes the response to a public URL, disclosing contents the attacker could not otherwise reach. For stored XSS, the attacker hosts an SVG containing a <script> element, submits its URL, and specifies an .svg filename. The resulting public URL executes JavaScript in the WordPress site's origin for any user who loads it, enabling session theft or administrative action chaining.

No verified public exploit code is available. See the WPScan Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-110033

Indicators of Compromise

Unexpected .svg, .html, or script-bearing files in the plugin's uploads or media directories
Outbound HTTP requests from the WordPress host to internal IP ranges, cloud metadata addresses such as 169.254.169.254, or localhost ports
New or modified files under the plugin upload path with filenames not matching standard booking workflows
Audit log entries showing Salon Staff accounts invoking the image import function repeatedly

Detection Strategies

Inspect WordPress access logs for POST requests from staff-tier accounts to the plugin's image handling endpoints
Review web server logs for GETs of SVG files from unauthenticated clients shortly after staff uploads
Scan the uploads directory for SVG files containing <script>, onload=, or javascript: strings
Correlate outbound DNS and HTTP activity from the web server against an allowlist of expected destinations

Monitoring Recommendations

Alert on any outbound request from WordPress PHP workers to RFC1918 ranges or cloud metadata endpoints
Monitor file creation events in wp-content/uploads/ for extensions other than standard image formats
Track role assignments and privilege changes for the Salon Staff role

How to Mitigate CVE-2026-110033

Immediate Actions Required

Upgrade the Salon Booking System plugin to version 10.31.11 or later
Audit all accounts holding the Salon Staff role or higher and revoke access for untrusted users
Scan the uploads directory for unexpected SVG or HTML files and remove any that contain executable content
Rotate credentials and session tokens if cloud metadata endpoints were reachable from the host

Patch Information

The vendor fixed the issue in Salon Booking System version 10.31.11. Update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Refer to the WPScan Vulnerability Analysis for advisory details.

Workarounds

Restrict assignment of the Salon Staff role until the plugin is updated
Deploy a web application firewall rule that blocks requests to the plugin's image fetch endpoint from non-administrator users
Configure the WordPress host firewall to deny egress to internal subnets and cloud metadata IPs
Serve wp-content/uploads/ with a Content-Security-Policy header that disables inline script execution for SVG assets

bash

# Nginx example: force SVG downloads instead of inline rendering
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "script-src 'none'; object-src 'none'";
}