The vulnerability is a stored cross‑site scripting flaw in the Salon Booking System plugin for WordPress versions up to and including 10.31.9. Attackers can submit malicious code through the sln[<checkout‑field‑key>] parameter in a public booking AJAX request. Because the plugin does not sanitize or escape the input in custom checkout fields of type Html or File, the payload is persisted and later executed whenever a user visits a booking or administration page, enabling the theft of session cookies, defacement, or more advanced attacks on users’ browsers. This weakness corresponds to CWE‑79.

The flaw affects any installation of the Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin that is version 10.31.9 or earlier, provided that the site administrator has configured at least one custom checkout field of type Html or File. All sites running the affected plugin and using such fields are vulnerable.

The CVSS score of 7.2 indicates moderate severity, and the attack requires no authentication, exploiting a public AJAX booking endpoint. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the unauthenticated nature and broad availability of the booking form raise the risk of exploitation. Successful exploitation can lead to user session hijacking, defacement, and the potential distribution of additional malware through the affected plugin’s front‑end.