Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2026-85127

VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress-extensions
Products
Vikbooking Hotel Booking Engine & Pms Vikbooking
CVE-2026-15346

VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress
Products
Vikbooking Hotel Booking Engine & Pms Wordpress
CVE-2026-15401

VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vbfX custom-field value is stored via the public-facing saveorder task, which has no capability or authentication check enforced by default, enabling fully unauthenticated submission of malicious payloads.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress
Products
Vikbooking Hotel Booking Engine & Pms Wordpress
CVE-2026-42683

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress
Products
Vikbooking Hotel Booking Engine & Pms Wordpress
CVE-2026-42737

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Path Traversal.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress
Products
Vikbooking Hotel Booking Engine & Pms Wordpress
CVE-2026-42762

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows DOM-Based XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress
Products
Vikbooking Hotel Booking Engine & Pms Wordpress
CVE-2023-32501

WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.6.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Pms
CVE-2025-5803

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress
Products
Vikbooking Hotel Booking Engine & Pms Wordpress
CVE-2025-49918

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Retrieve Embedded Sensitive Data.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp Wordpress
Products
Vikbooking Hotel Booking Engine & Pms Wordpress
CVE-2024-11641

VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Pms
CVE-2024-13616

VikBooking < 1.7.2 - Admin+ Stored XSS

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Pms
CVE-2024-2441

VikBooking < 1.6.8 - Insecure Direct Object References

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Pms
CVE-2024-2749

VikBooking < 1.6.8 - Broken Access Control

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Pms
CVE-2022-27862

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE

Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Property Management System Plugin
CVE-2022-27863

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Sensitive Data Exposure vulnerability

Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by guessing / brute-forcing easy predictable booking IDs via search POST requests.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Property Management System Plugin
CVE-2023-25707

WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.12 versions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Pms
CVE-2023-24396

WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.11 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vikbooking Hotel Booking Engine \& Pms
CVE-2022-1528

VikBooking < 1.5.9 - Reflected Cross-Site Scripting

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Vik Booking
CVE-2022-1409

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Vikwp
Products
Hotel Booking Engine \& Pms
CVE-2022-1408

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Hotel Booking Engine \& Pms