Salon Booking System – Appointment Booking for Salons, Barbershops & Spas

75 Quality Score

Active Installs

15/30

The popularity score of 49 out of 30 is inflated by recency, but only 2,000 active installs means the user base is tiny compared to top competitors like Amelia at 90,000 installs.

Update Freshness

25/25

Maintenance scores a perfect 100 out of 25 thanks to a recent update on July 8, 2026, and a low minimum PHP requirement of 7.4.8 that keeps it compatible with most hosts.

User Rating

13/15

User ratings are strong at 88 out of 15, drawn from 179 reviews, indicating that the people who do use it tend to be satisfied.

Support Health

8/15

Support health is the weakest area at 50 out of 15, with 0 of 6 support threads marked as resolved, which is a real concern for anyone who might need troubleshooting help.

WP Compatibility

15/15

Compatibility is a perfect 100 out of 15 because it is tested with WordPress 6.9.4 and requires only WordPress 4.1 as a minimum.

Scores higher than 43% of indexed plugins

About

Appointment booking built only for salons, barbershops and spas. Set it up in minutes by chatting with the AI assistant.

Active Installs 2k+

Rating ★★★★ 4.4/5

Last Updated 2026-09-17 2:50pm GMT

Requires WordPress 6.0+

Tested Up To 7.0.5

Requires PHP 7.4.8+

Security History

38 known vulnerabilities, all patched

4 Critical 6 High 27 Medium 1 Low

Most recent: September 8, 2026

View details ▸

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Missing Authorization Medium

September 8, 2026 Patched in [] CVE-2026-81793

Salon Booking System <= 10.30.19 - Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass Medium

August 10, 2026 Patched in ["10.30.20"] CVE-2026-11887

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.30.26 - Missing Authorization Medium

August 7, 2026 Patched in ["10.30.27"] CVE-2026-66453

Salon Booking System – Free Version <= 10.30.33 - Missing Authorization Medium

August 6, 2026 Patched in ["10.30.34"] CVE-2026-17021

Salon Booking System – Free Version < 10.31.3 - Missing Authorization to Unauthenticated Google Calendar Connection Hijack Medium

August 6, 2026 Patched in ["10.31.3"] CVE-2026-17023

Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Booking Information Disclosure Medium

August 6, 2026 Patched in ["10.30.34"] CVE-2026-17022

Salon Booking System – Free Version < 10.31.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure Medium

August 6, 2026 Patched in ["10.31.3"] CVE-2026-17020

Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter High

July 9, 2026 Patched in ["10.30.33"] CVE-2026-15070

Salon Booking System – Free Version <= 10.30.25 - Missing Authorization Medium

May 10, 2026 Patched in ["10.30.26"] CVE-2026-42666

Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal High

May 1, 2026 Patched in ["10.30.26"] CVE-2026-6320

Salon Booking System – Free Version <= 10.30.24 - Unauthenticated Insecure Direct Object Reference Medium

April 21, 2026 Patched in ["10.30.25"] CVE-2026-40768

Salon booking system <= 10.30.3 - Authenticated (Subscriber+) Information Exposure Low

January 21, 2026 Patched in ["10.30.4"] CVE-2025-67954

Salon booking system <= 10.30.3 - Cross-Site Request Forgery Medium

December 7, 2025 Patched in ["10.30.4"] CVE-2025-66531

Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution Medium

September 10, 2025 Patched in ["10.24"] CVE-2025-8492

Salon booking system <= 10.16 - Cross-Site Request Forgery to Arbitrary Post/Page Deletion Medium

May 15, 2025 Patched in ["10.17"] CVE-2025-47583

Salon booking system <= 10.29.6 - Missing Authorization Medium

April 4, 2025 Patched in [] CVE-2025-32220

Salon booking system <= 10.11 - Authenticated Privilege Escalation High

April 1, 2025 Patched in ["10.15"] CVE-2025-31560

Salon booking system <= 10.9 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

September 25, 2024 Patched in ["10.9.1"] CVE-2024-47316

Salon Booking System <= 10.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

September 13, 2024 Patched in ["10.9.4"] CVE-2024-9882

Salon booking system <= 10.8.1 - Unauthenticated Open Redirect Medium

August 16, 2024 Patched in ["10.9"] CVE-2024-43280

Salon booking system <= 10.7 - Authenticated (Administrator+) SQL Injection Critical

August 1, 2024 Patched in ["10.8"] CVE-2024-39658

Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload Critical

June 18, 2024 Patched in ["10.3"] CVE-2024-3229

Salon booking system <= 9.9 - Missing Authorization Medium

June 7, 2024 Patched in ["10.0"] CVE-2024-4468

Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion Critical

May 17, 2024 Patched in ["10.0"] CVE-2024-4442

Salon booking system <= 9.6.5 - Cross-Site Request Forgery to Settings Update Medium

April 26, 2024 Patched in ["9.6.6"] CVE-2024-2429

Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings Medium

April 5, 2024 Patched in ["9.6.6"] CVE-2024-2603

Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting Medium

April 5, 2024 Patched in ["9.6.6"] CVE-2024-2439

Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload Critical

March 28, 2024 Patched in ["9.5.1"] CVE-2024-30510

Salon booking system <= 9.6.2 - Unauthenticated Stored Cross-Site Scripting via 'sms_prefix' High

March 27, 2024 Patched in ["9.6.3"] CVE-2024-2102

Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting Medium

March 27, 2024 Patched in ["9.6.3"] CVE-2024-2101

Salon booking system < 8.7 - Authenticated (Editor+) Privilege Escalation High

November 23, 2023 Patched in ["8.7"] CVE-2023-48319

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Medium

July 18, 2023 Patched in ["8.4.9"] CVE-2023-33999

Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer Medium

June 27, 2023 Patched in ["8.4.8"] CVE-2023-3427

Salon booking system <= 7.9 - Reflected Cross-Site Scripting Medium

November 8, 2022 Patched in ["7.9.4"] CVE-2022-43487

Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Data Disclosure Medium

March 21, 2022 Patched in ["7.6.3"] CVE-2022-0919

Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Information Disclosure High

March 21, 2022 Patched in ["7.6.3"] CVE-2022-0920

Freemius SDK <= 2.4.2 - Missing Authorization Checks Medium

March 4, 2022 Patched in ["7.6.3"] CVE-2022-4974

Salon booking system < 6.3.1 - Stored Cross-Site Scripting Medium

June 21, 2021 Patched in ["6.3.1"] CVE-2021-24429

What It Does

Salon Booking System adds an appointment scheduling flow to WordPress sites, letting salon, spa, and wellness businesses accept, manage, and confirm bookings through a calendar interface. It covers the core needs of single-location service businesses: displaying available slots, capturing customer details, and organizing reservations in the admin dashboard.

Who It's For

This plugin fits small to mid-sized salons, spas, barbershops, and wellness studios that want a budget-friendly scheduling tool on their existing WordPress site rather than a third-party SaaS platform. It is best suited to single-location operations with a handful of staff and a fixed menu of services.

Who Should Skip It

Multi-location chains and high-volume businesses should skip this plugin, since the 2,000 active installs and 0% resolved support rate suggest limited capacity to handle complex or large-scale deployments. Sites expecting polished, real-time SMS reminders or deep payment integrations will likely need a more mature alternative.

The Bottom Line

Salon Booking System is a tidy, well-maintained scheduling plugin with excellent user ratings, but its tiny install base and 0% support resolution rate make it a calculated risk. It is worth trying for small single-location salons comfortable troubleshooting on their own, but risk-averse buyers will be safer choosing Amelia or Bookly.

Pick this if you want a much larger install base of 60,000 and a polished one-on-one scheduling experience, though it is less salon-specific.

Booking for Appointments and Events Calendar – Amelia 83/100

Choose Amelia if you need 90,000-install reliability, multi-staff calendars, and paid add-ons for SMS or payment gateways.

Booking Calendar 83/100

Opt for Booking Calendar if you want a simple, well-established 50,000-install tool for resource or room reservations rather than service-based salons.

Online Scheduling and Appointment Booking System – Bookly 82/100

Go with Bookly if you want a salon-focused plugin with a large 60,000-install community and a modular paid extension ecosystem.

WP Booking Calendar 81/100

Pick WP Booking System if you need a 20,000-install calendar plugin with strong visual customization for availability grids.