Maciej Komorowski

The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.

**Name of the Vulnerable Software and Affected Versions** Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA versions prior to 6.89 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `comment` parameter. Attackers can inject arbitrary web scripts that execute when a user accesses the affected page. This is exploitable after a comment from the attacker's email is approved; since default WordPress installations typically only moderate the first comment from a specific email, subsequent comments may be auto-approved, immediately exposing the payload to visitors. **Recommendations** Update Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA to version 6.89 or later. Avoid using the `comment` parameter for unverified user input until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Simple Membership versions prior to 4.8.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. Additionally, unauthenticated attackers can exploit this issue if the Enable Free Membership feature is active, as it allows anonymous front-end registration and profile submission via the `country` parameter. **Recommendations** Update Simple Membership to version 4.8.5 or later. Restrict the use of the `country` parameter or disable the Enable Free Membership feature as a temporary mitigation measure.