Spasalon

Spasalon has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 1 is fixed and 1 remains unpatched as of November 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Request Forgery, behind 1 of the records (50%). Other recurring categories include Improper Neutralization Of Input During Web Page Generation.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, one record each. Spasalon is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

5.2/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all Spasalon vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-125843

Spasalon <= 3.0 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

2 records


2026-11-11 00:00	Spasalon <= 3.0 - Cross-Site Request Forgery Spasalon <= 3.0	`CVE-2026-125843`	4.3 Medium	beopseong.kim	No
2022-02-14 00:00	Multiple Themes (Various Versions) - Reflected Cross-Site Scripting Spasalon < 2.2.1	`N/A`	6.1 Medium	WPScanTeam	Yes

Showing 1–2 of 2 reports

Latestv3.0

Spasalon

Author

webriti

4.2(59)

84/100

Last Updated

2026-08-31 (2mo ago)

Active Installs

300+

Downloads

350,232

Requires WP

4.5+

Requires PHP

5.4+

Created

2013-09-17 (13y ago)

SpaSalon is a fully responsive multi-purpose theme, best suitable for SPAs, salons, beauty, care, hair, health, hospitality, massage, medical, parlor, physiotherapy, wellness, yoga, health blogs, and for any type of business. SpaSalon is fast and lightweight, and built with speed, SEO and usability in mind. SpaSalon has 9 widget-ready areas to help you create any type of site. It supports drop-down menus, built-in widgets, and Contact Form 7 styling. Make your website exactly the way you want it: using the Customizer, you see the changes take place right in front of you, before publishing. You can also create an effective online shop presence, since SpaSalon supports WooCommerce, and separate WooCommerce sidebars were added to the shop pages, to add different sets of widgets from the default templates. SpaSalon PRO supports Contact Form 7 and Google Maps; offers you more widget-ready areas and built-in widgets for Teams, Services, Product Sliders, etc. SpaSalon PRO also includes a number of predefined templates (about us, contact us, portfolio etc.) and even let's you customize the layout of the sidebars on the Business Template without adding a single line of code. Navigate to Appearance > Customize to start personalizing SpaSalon.