The Salon Booking System WordPress plugin before version 10.31.11 fails to validate a user-supplied image URL before fetching it server‑side and writing the response to a publicly accessible location under an attacker-chosen filename, enabling an attacker to retrieve internal resources via SSRF and to store a malicious SVG that runs arbitrary scripts in the site's origin when accessed.

The vulnerability affects the Salon Booking System WordPress plugin for all users with the Salon Staff role or higher, on all releases prior to 10.31.11.

The CVSS score is not disclosed, but the presence of stored XSS and SSRF indicates high potential impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an adversary can authenticate with Salon Staff level or higher on the target site and submit a crafted request to the REST endpoint that accepts the image_url parameter; the attacker then triggers the server to fetch the supplied URL and store the result in a public directory, thereby disclosing internal data or executing malicious scripts for any site visitor.