{"id":"CVE-2024-9882","aliases":["EUVD-2025-15207","GHSA-f2vf-33g3-fwm2"],"status":"published","title":"Salon Booking System \u003c 10.9.4 - Admin+ Stored XSS","description":"The Salon Booking System, Appointment Scheduling for Salons, Spas \u0026 Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00272,"percentile":0.19688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-05-15T20:07:24Z","modified":"2026-06-17T08:25:26Z","products":[{"vendor":"salonbookingsystem","product":"salon_booking_system"},{"vendor":"unknown","product":"salon booking system, appointment scheduling for salons, spas \u0026 small businesses"},{"vendor":"wordpresschef","product":"salon booking system, appointment scheduling for salons, spas \u0026 small businesses"}],"references":[{"url":"https://wpscan.com/vulnerability/7f7667fd-6ac6-4c90-aaf0-c7862bd8e9bd/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9882"},{"url":"https://wpscan.com/vulnerability/7f7667fd-6ac6-4c90-aaf0-c7862bd8e9bd"},{"url":"https://github.com/advisories/GHSA-f2vf-33g3-fwm2"}],"sources":{"cve":[{"id":"CVE-2024-9882","title":"Salon Booking System \u003c 10.9.4 - Admin+ Stored XSS","description":"The Salon Booking System, Appointment Scheduling for Salons, Spas \u0026 Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-05-15T20:07:24.507Z","modified":"2025-05-17T02:52:59.079Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:06.147811Z"}],"euvd":[{"id":"EUVD-2025-15207","description":"The Salon Booking System, Appointment Scheduling for Salons, Spas \u0026 Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-05-15T20:07:24Z","modified":"2025-05-17T02:52:59Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:45.127966Z"}],"ghsa":[{"id":"GHSA-f2vf-33g3-fwm2","title":"The Salon Booking System, Appointment Scheduling for Salons, Spas \u0026 Small Businesses WordPress...","description":"The Salon Booking System, Appointment Scheduling for Salons, Spas \u0026 Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-05-15T21:31:34Z","modified":"2025-06-12T18:31:12Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:42.831943Z"}],"nvd":[{"id":"CVE-2024-9882","description":"The Salon Booking System, Appointment Scheduling for Salons, Spas \u0026 Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-05-15T20:16:01.62Z","modified":"2026-06-17T08:25:26.14Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}