Decryption key:
Salon Booking - Wordpress Plugin v10.31.6
16.09.2026 - 10.31.6
* Security fix: allow-listed and escaped the booking editor `mode` parameter so a crafted admin link can no longer inject HTML attributes into the booking metabox (administrator reflected XSS)
* New: staff can add a booking on a slot they locked from the day calendar; a warning is shown after save. Holiday rules and Google Calendar / external locks still block the booking
* New: from the back-end booking editor, staff can save a start time that does not snap to the booking interval (for example 14:35 when slots are every 30 minutes). The public booking form is unchanged; this is not available in basic availability mode
* Fixed: the booking editor now loads available times for the reservation’s own shop (Multi-Shops), so a day closed at one location no longer shows the other location’s slots
* Fixed: the booking page now opts itself out of full-page caches (WP Rocket, WP Super Cache, W3 Total Cache and others), so two customers no longer share the same in-progress reservation
* Fixed: staff no longer receive a “new booking” alert while the reservation is still an auto-draft or awaiting payment