CVE-2026-94668 Overview
CVE-2026-94668 is a reflected Cross-Site Scripting (XSS) vulnerability in the Dimitri Grassi Salon Booking System WordPress plugin. The flaw affects all plugin versions up to and including 10.31.5. The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated or anonymous victim, execute arbitrary JavaScript in the victim's browser session. The scope change in the CVSS vector indicates that successful exploitation can impact resources beyond the vulnerable component.
Critical Impact
Reflected XSS enables session hijacking, credential theft, and administrative action abuse when a privileged user is lured into clicking a crafted link.
Affected Products
- Dimitri Grassi Salon Booking System WordPress plugin versions up to and including 10.31.5
- WordPress sites with the plugin installed and activated
- Salon and appointment-management websites exposing plugin endpoints to unauthenticated visitors
Discovery Timeline
- 2026-10-09 - CVE-2026-94668 published to the National Vulnerability Database
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2026-94668
Vulnerability Analysis
The Salon Booking System plugin fails to sanitize or encode user-controlled input before rendering it back in HTTP response pages. An attacker crafts a URL containing JavaScript payloads in a vulnerable parameter. When the victim loads the URL, the plugin reflects the payload into the response HTML without escaping, triggering script execution in the victim's browser.
Because the CVSS scope is marked as changed, injected scripts can access cookies, session storage, and DOM content tied to the WordPress origin. This elevates the risk beyond simple content manipulation and enables attacks against administrator accounts.
User interaction is required, which is typical of reflected XSS. Attackers commonly deliver these payloads through phishing emails, forum posts, or malicious advertising that targets booking-site operators.
Root Cause
The root cause is missing output encoding for request parameters consumed by plugin page handlers. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses() for safe rendering, but the plugin does not apply them consistently to the affected request parameters before echoing them into the response.
Attack Vector
Exploitation requires an attacker to deliver a crafted URL to a victim with an active session on the vulnerable WordPress site. Once the victim loads the URL, the reflected payload executes with the victim's privileges. For administrator targets, this allows creating backdoor accounts, injecting persistent scripts, or exfiltrating session cookies. Full technical details are available in the Patchstack XSS Vulnerability Advisory.
Detection Methods for CVE-2026-94668
Indicators of Compromise
- HTTP request logs containing URL parameters with <script>, onerror=, javascript:, or encoded variants targeting plugin endpoints
- Unexpected administrator accounts, modified plugin settings, or new scheduled tasks created shortly after suspicious inbound referrers
- Outbound beacons from browser sessions to attacker-controlled domains following access to Salon Booking System pages
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that block common XSS payload patterns in query strings sent to /wp-content/plugins/salon-booking-system/ paths
- Correlate web server access logs with WordPress audit logs to identify requests that reflect script content back to privileged users
- Hunt for anomalous JavaScript execution patterns in Content Security Policy (CSP) violation reports
Monitoring Recommendations
- Enable verbose logging on the reverse proxy or WAF to capture full request URIs and referrers for plugin endpoints
- Monitor WordPress user and role changes using an audit plugin and alert on out-of-cycle administrative actions
- Track browser-side errors and CSP violations centrally to surface attempted script injections early
How to Mitigate CVE-2026-94668
Immediate Actions Required
- Update the Salon Booking System plugin to a version later than 10.31.5 as soon as the vendor publishes a fixed release
- Restrict administrator access to the WordPress backend using IP allow-listing or VPN until the patch is applied
- Instruct administrators and staff to avoid clicking unsolicited links referencing booking pages or plugin parameters
Patch Information
The affected version range is n/a through 10.31.5. Review the Patchstack XSS Vulnerability Advisory for the current patched version and upgrade guidance from the vendor.
Workarounds
- Deploy a WAF rule set that blocks XSS payloads targeting Salon Booking System request parameters
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Disable or uninstall the plugin on affected sites until a verified patch is available
# Example restrictive Content Security Policy header for WordPress
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
