WP-Safety

Yatoon Booking System Security & Risk Analysis

wordpress.org/plugins/yatoon-booking-system

Beautiful, full-featured appointment booking system for salons, spas, and service businesses. Works 100% locally — no third-party accounts required.

0 active installs v1.1.7 PHP 7.4+ WP 5.8+ Updated Apr 1, 2026
appointmentsbookingsalonschedulingspa
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Plugin page Download
Safety Verdict

Is Yatoon Booking System Safe to Use in 2026?

Generally Safe

Score 100/100

Yatoon Booking System has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 4mo ago
Risk Assessment

The 'yatoon-booking-system' plugin v1.1.7 demonstrates a generally strong security posture, with excellent adherence to secure coding practices. The plugin utilizes prepared statements for all its SQL queries and boasts a very high rate of output escaping, minimizing the risk of cross-site scripting (XSS) vulnerabilities. The absence of critical or high-severity taint flows further reinforces this positive outlook. Furthermore, the plugin has no recorded vulnerability history, which suggests a commitment to maintaining a secure codebase.

Key Concerns

  • AJAX handlers without auth checks
  • Bundled outdated library (Freemius v1.0)
Vulnerabilities
None known

Yatoon Booking System Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

Yatoon Booking System Release Timeline

v1.17
v1.1.5
Code Analysis
Analyzed Apr 16, 2026

Yatoon Booking System Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
266 prepared
Unescaped Output
17
1100 escaped
Nonce Checks
46
Capability Checks
50
File Operations
3
External Requests
1
Bundled Libraries
1

Bundled Libraries

Freemius1.0

SQL Query Safety

100% prepared266 total queries

Output Escaping

98% escaped1117 total outputs
Data Flows · Security
All sanitized

Data Flow Analysis

22 flows
display_blacklist_page (includes/class-yatoon-admin.php:385)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
5 unprotected

Yatoon Booking System Attack Surface

Entry Points51
Unprotected5

AJAX Handlers 49

authwp_ajax_yatoon_test_connectionincludes/class-yatoon-admin.php:17
authwp_ajax_yatoon_test_vagaro_connectionincludes/class-yatoon-admin.php:18
authwp_ajax_yatoon_sync_nowincludes/class-yatoon-admin.php:19
authwp_ajax_yatoon_delete_serviceincludes/class-yatoon-admin.php:20
authwp_ajax_yatoon_get_staff_servicesincludes/class-yatoon-admin.php:21
authwp_ajax_yatoon_update_staff_servicesincludes/class-yatoon-admin.php:22
authwp_ajax_yatoon_update_optionincludes/class-yatoon-admin.php:23
authwp_ajax_yatoon_add_optionincludes/class-yatoon-admin.php:24
authwp_ajax_yatoon_reorder_optionsincludes/class-yatoon-admin.php:25
authwp_ajax_yatoon_get_addon_optionsincludes/class-yatoon-admin.php:26
authwp_ajax_yatoon_delete_bookingsincludes/class-yatoon-admin.php:27
authwp_ajax_yatoon_export_bookingsincludes/class-yatoon-admin.php:28
authwp_ajax_yatoon_delete_waitlistincludes/class-yatoon-admin.php:29
authwp_ajax_yatoon_export_waitlistincludes/class-yatoon-admin.php:30
authwp_ajax_yatoon_delete_messagesincludes/class-yatoon-admin.php:31
authwp_ajax_yatoon_export_messagesincludes/class-yatoon-admin.php:32
authwp_ajax_yatoon_get_serviceincludes/class-yatoon-admin.php:33
authwp_ajax_yatoon_save_serviceincludes/class-yatoon-admin.php:34
authwp_ajax_yatoon_toggle_serviceincludes/class-yatoon-admin.php:35
authwp_ajax_yatoon_get_service_optionsincludes/class-yatoon-ajax.php:13
noprivwp_ajax_yatoon_get_service_optionsincludes/class-yatoon-ajax.php:14
authwp_ajax_yatoon_get_available_staffincludes/class-yatoon-ajax.php:16
noprivwp_ajax_yatoon_get_available_staffincludes/class-yatoon-ajax.php:17
authwp_ajax_yatoon_diagnose_serviceincludes/class-yatoon-ajax.php:20
authwp_ajax_yatoon_fix_variation_idsincludes/class-yatoon-ajax.php:21
authwp_ajax_yatoon_get_available_timesincludes/class-yatoon-ajax.php:23
noprivwp_ajax_yatoon_get_available_timesincludes/class-yatoon-ajax.php:24
authwp_ajax_yatoon_get_next_availableincludes/class-yatoon-ajax.php:26
noprivwp_ajax_yatoon_get_next_availableincludes/class-yatoon-ajax.php:27
authwp_ajax_yatoon_create_bookingincludes/class-yatoon-ajax.php:29
noprivwp_ajax_yatoon_create_bookingincludes/class-yatoon-ajax.php:30
authwp_ajax_yatoon_toggle_staff_bookableincludes/class-yatoon-ajax.php:33
authwp_ajax_yatoon_update_service_orderincludes/class-yatoon-ajax.php:36
authwp_ajax_yatoon_rebuild_staff_servicesincludes/class-yatoon-ajax.php:37
authwp_ajax_yatoon_reorder_booking_groupincludes/class-yatoon-ajax.php:40
authwp_ajax_yatoon_send_contact_messageincludes/class-yatoon-ajax.php:43
noprivwp_ajax_yatoon_send_contact_messageincludes/class-yatoon-ajax.php:44
authwp_ajax_yatoon_join_waitlistincludes/class-yatoon-ajax.php:47
noprivwp_ajax_yatoon_join_waitlistincludes/class-yatoon-ajax.php:48
authwp_ajax_yatoon_debug_date_bookingsincludes/class-yatoon-ajax.php:50
authwp_ajax_yatoon_debug_square_availabilityincludes/class-yatoon-ajax.php:52
authwp_ajax_yatoon_cancel_bookingincludes/class-yatoon-ajax.php:54
authwp_ajax_yatoon_delete_single_bookingincludes/class-yatoon-ajax.php:56
authwp_ajax_yatoon_sync_bookings_from_squareincludes/class-yatoon-ajax.php:58
authwp_ajax_yatoon_twilio_testincludes/class-yatoon-ajax.php:4347
authwp_ajax_yatoon_google_cal_callbackincludes/class-yatoon-ajax.php:4368
authwp_ajax_yatoon_save_staffincludes/class-yatoon-ajax.php:4392
authwp_ajax_yatoon_delete_staffincludes/class-yatoon-ajax.php:4436
authwp_ajax_yatoon_get_staff_memberincludes/class-yatoon-ajax.php:4454

Shortcodes 2

[yatoon_customer_portal] includes/class-yatoon-customer-portal.php:33
[yatoon_booking] includes/class-yatoon-frontend.php:9
WordPress Hooks 14
filtercron_schedulesincludes/class-yatoon-activator.php:235
actionplugins_loadedincludes/class-yatoon-activator.php:285
actionadmin_menuincludes/class-yatoon-admin.php:13
actionadmin_initincludes/class-yatoon-admin.php:14
actionadmin_enqueue_scriptsincludes/class-yatoon-admin.php:15
actionadmin_post_sbs_save_business_hoursincludes/class-yatoon-admin.php:16
actionupdate_option_sbs_sync_intervalincludes/class-yatoon-admin.php:38
actionadmin_initincludes/class-yatoon-ajax.php:4473
actionyatoon_sync_square_dataincludes/class-yatoon-cron.php:12
actionwp_enqueue_scriptsincludes/class-yatoon-customer-portal.php:36
filterwp_mail_content_typeincludes/class-yatoon-customer-portal.php:218
actionwp_enqueue_scriptsincludes/class-yatoon-frontend.php:10
actionplugins_loadedyatoon-booking-system.php:114
actionplugins_loadedyatoon-booking-system.php:127

Scheduled Events 2

yatoon_sync_square_data
yatoon_sync_square_data
Maintenance & Trust

Yatoon Booking System Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedApr 1, 2026
PHP min version7.4
Downloads112

Community Trust

Rating0/100
Number of ratings0
Active installs0
Alternatives

Yatoon Booking System Alternatives

Clienta Booking

Clienta Booking

clienta-booking

A
100

Add a Clienta booking widget to your WordPress website. Let customers book appointments directly on your site.

0 No CVEs
EDSA GlowTrack Connector

EDSA GlowTrack Connector

edsa-glowtrack-connector

A
100

Connect WordPress sites to EDSA GlowTrack for public booking, service menus, provider listings, intake/contact forms, and client portal entry points.

0 No CVEs
TimeTailor Salon Booking

TimeTailor Salon Booking

timetailor-salon-booking

A
100

Salon booking software for WordPress. Take online appointments, accept Stripe payments, and embed your service menu on any page — built for salons.

0 No CVEs
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

latepoint

F
20

Appointment booking plugin for WordPress. Let clients self-schedule 24/7, accept payments at booking, and reduce no-shows, all from your WordPress sit …

100K 2 unpatched
Simply Schedule Appointments

Simply Schedule Appointments

simply-schedule-appointments

A
88

Unlimited appointments, booking calendars, and notifications. Powerful appointment booking plugin and booking system. Start scheduling for free today!

60K 34 CVEs
Developer Profile

Yatoon Booking System Developer Profile

yatoon

3 plugins · 0 total installs

94
trust score
Avg Security Score
100/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Yatoon Booking System

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/yatoon-booking-system/assets/css/style.css/wp-content/plugins/yatoon-booking-system/assets/css/bootstrap.min.css/wp-content/plugins/yatoon-booking-system/assets/css/select2.min.css/wp-content/plugins/yatoon-booking-system/assets/css/flatpickr.min.css/wp-content/plugins/yatoon-booking-system/assets/css/iziToast.min.css/wp-content/plugins/yatoon-booking-system/assets/css/admin.css/wp-content/plugins/yatoon-booking-system/assets/js/bootstrap.bundle.min.js/wp-content/plugins/yatoon-booking-system/assets/js/select2.min.js+5 more
Version Parameters
yatoon-booking-system/assets/css/style.css?ver=yatoon-booking-system/assets/css/bootstrap.min.css?ver=yatoon-booking-system/assets/css/select2.min.css?ver=yatoon-booking-system/assets/css/flatpickr.min.css?ver=yatoon-booking-system/assets/css/iziToast.min.css?ver=yatoon-booking-system/assets/css/admin.css?ver=yatoon-booking-system/assets/js/bootstrap.bundle.min.js?ver=yatoon-booking-system/assets/js/select2.min.js?ver=yatoon-booking-system/assets/js/flatpickr.min.js?ver=yatoon-booking-system/assets/js/iziToast.min.js?ver=yatoon-booking-system/assets/js/admin.js?ver=yatoon-booking-system/assets/js/booking.js?ver=yatoon-booking-system/assets/js/customer-portal.js?ver=

HTML / DOM Fingerprints

CSS Classes
yatoon-booking-systemyatoon-booking-optionsyatoon-booking-formyatoon-booking-staff-selectionyatoon-booking-service-selectionyatoon-booking-date-pickeryatoon-booking-time-picker
HTML Comments
<!-- Free version: no Pro features --><!-- Freemius Integration --><!-- Free stubs: must load before admin/frontend/ajax --><!-- Hooks -->
Data Attributes
data-yatoon-booking-id
JS Globals
yatoon_booking_fsYATOON_VERSIONYATOON_PLUGIN_DIRYATOON_PLUGIN_URLYATOON_PLUGIN_FILEYATOON_UPGRADE_URL+1 more
REST Endpoints
/wp-json/yatoon/v1/bookings/wp-json/yatoon/v1/services/wp-json/yatoon/v1/staff/wp-json/yatoon/v1/availability
Shortcode Output
[yatoon_booking_form]
FAQ

Frequently Asked Questions about Yatoon Booking System