Vikappointments Vulnerabilities

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is...

CVSS:

7.5

Affected:

up to 1.2.19

Fixed in:

1.2.20

Disclosed:

Aug 4, 2026

CVE-2026-15918 on NVD →

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.16. This is due to missing or incorrect nonce validation on the executeRole() function. This makes it possible for unauthenticated attackers to configure plugin settings v...

CVSS:

4.3

Affected:

up to 1.2.16

Fixed in:

1.2.17

Disclosed:

Jan 15, 2025

CVE-2025-22719 on NVD →