Vikbooking Vulnerabilities

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVSS:

7.2

Affected:

up to 1.8.13

Fixed in:

1.8.14

Disclosed:

Jul 23, 2026

CVE-2026-15401 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

6.1

Affected:

up to 1.8.13

Fixed in:

1.8.14

Disclosed:

Jul 23, 2026

CVE-2026-15346 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVSS:

7.2

Affected:

up to 1.8.8

Fixed in:

1.8.9

Disclosed:

Jul 7, 2026

CVE-2026-6820 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVSS:

7.2

Affected:

up to 1.8.8

Fixed in:

1.8.9

Disclosed:

Jul 7, 2026

CVE-2026-6818 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged req...

CVSS:

4.3

Affected:

up to 1.8.12

Fixed in:

1.8.13

Disclosed:

Jul 1, 2026

CVE-2026-57723 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

6.1

Affected:

up to 1.8.12

Fixed in:

1.8.13

Disclosed:

Jun 30, 2026

CVE-2026-12754 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVSS:

7.2

Affected:

up to 1.8.9

Fixed in:

1.8.10

Disclosed:

Jun 1, 2026

CVE-2026-42762 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 1.8.10. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote cod...

CVSS:

9.1

Affected:

up to 1.8.10

Fixed in:

1.8.11

Disclosed:

May 27, 2026

CVE-2026-42737 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVSS:

7.2

Affected:

up to 1.8.8

Fixed in:

1.8.9

Disclosed:

May 20, 2026

CVE-2026-42683 on NVD →

[en] Insertion of Sensitive Information Into Sent Data vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Retrieve Embedded Sensitive Data.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.

Affected:

up to 1.8.2

Fix:

No patched version reported

Disclosed:

Dec 18, 2025

CVE-2025-49918 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

7.5

Affected:

up to 1.8.2

Fixed in:

1.8.3

Disclosed:

Nov 7, 2025

CVE-2025-49918 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.8.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.8.2

Fixed in:

1.8.3

Disclosed:

Oct 21, 2025

CVE-2025-5803 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 1.7.2

Fixed in:

1.7.2

Disclosed:

May 15, 2025

CVE-2024-13616 on NVD →

[en] Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.7.2.

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Mar 27, 2025

CVE-2025-22670 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

CVSS:

4.4

Affected:

up to 1.7.1

Fixed in:

1.7.2

Disclosed:

Mar 3, 2025

CVE-2024-13616 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged reques...

CVSS:

4.3

Affected:

up to 1.7.2

Fixed in:

1.7.3

Disclosed:

Feb 3, 2025

CVE-2025-22670 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privilege...

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Jan 26, 2025

CVE-2024-11641 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via...

CVSS:

8.8

Affected:

up to 1.7.2

Fixed in:

1.7.3

Disclosed:

Jan 25, 2025

CVE-2024-11641 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) de...

Affected:

up to 1.6.8

Fixed in:

1.6.8

Disclosed:

May 10, 2024

CVE-2024-2749 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allow...

Affected:

up to 1.6.8

Fixed in:

1.6.8

Disclosed:

May 10, 2024

CVE-2024-2441 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to unauthorized access due to insufficient capability checking in all versions up to, and including, 1.6.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify categories and perform several un...

CVSS:

5.4

Affected:

up to 1.6.7

Fixed in:

1.6.8

Disclosed:

Apr 19, 2024

CVE-2024-2749 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.7 via the option endpoint due to missing validation on the 'task' user controlled key. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVSS:

4.3

Affected:

up to 1.6.7

Fixed in:

1.6.8

Disclosed:

Apr 19, 2024

CVE-2024-2441 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VikBooking Hotel Booking Engine & PMS allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.6.7.

Affected:

up to 1.6.8

Fixed in:

1.6.8

Disclosed:

Apr 18, 2024

CVE-2024-32563 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVSS:

6.1

Affected:

up to 1.6.7

Fixed in:

1.6.8

Disclosed:

Apr 16, 2024

CVE-2024-32563 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.6.1 versions.

Affected:

up to 1.6.2

Fixed in:

1.6.2

Disclosed:

Nov 9, 2023

CVE-2023-32501 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.12 versions.

Affected:

up to 1.6.0

Fixed in:

1.6.0

Disclosed:

May 23, 2023

CVE-2023-25707 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.11 versions.

Affected:

up to 1.6.0

Fixed in:

1.6.0

Disclosed:

Apr 6, 2023

CVE-2023-24396 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the saveconfig function. This makes it possible for unauthenticated attackers to invoke this function via a forged...

CVSS:

5.4

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the savetmplfile function. This makes it possible for unauthenticated attackers to invoke this function via a forge...

CVSS:

5.4

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the savetranslationstay function. This makes it possible for unauthenticated attackers to invoke this function via...

CVSS:

5.4

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the savetranslation function. This makes it possible for unauthenticated attackers to invoke this function via a fo...

CVSS:

5.4

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the save_admin_widgets function. This makes it possible for unauthenticated attackers to invoke this function via a...

CVSS:

5.3

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the exec_admin_widget function. This makes it possible for unauthenticated attackers to invoke this function via a...

CVSS:

4.3

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the admin_widgets_welcome function. This makes it possible for unauthenticated attackers to invoke this function vi...

CVSS:

4.3

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation on the listenTosFieldSavingTask function. This makes it possible for unauthenticated attackers to invoke this function...

CVSS:

4.3

Affected:

up to 1.6.1

Fixed in:

1.6.2

Disclosed:

Feb 15, 2023

CVE-2023-32501 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation on multiple functions in the admin/controller.php file. This makes it possible for unauthenticated attackers to modify...

CVSS:

4.3

Affected:

up to 1.6.1

Fixed in:

1.6.2

Disclosed:

Feb 15, 2023

CVE-2023-32501 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the widgets_watch_data function. This makes it possible for unauthenticated attackers to invoke this function via...

CVSS:

4.3

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.12. This is due to missing or incorrect nonce validation on the exec_multitask_widgets function. This makes it possible for unauthenticated attackers to invoke this function v...

CVSS:

4.3

Affected:

up to 1.5.12

Fixed in:

1.6.0

Disclosed:

Feb 15, 2023

CVE-2023-25707 on NVD →

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.5.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

CVSS:

4.4

Affected:

up to 1.5.12

Fixed in:

1.5.12

Disclosed:

Jan 27, 2023

CVE-2023-24396 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting

Affected:

up to 1.5.9

Fixed in:

1.5.9

Disclosed:

May 30, 2022

CVE-2022-1528 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them...

Affected:

up to 1.5.8

Fixed in:

1.5.8

Disclosed:

May 16, 2022

CVE-2022-1407 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

Affected:

up to 1.5.8

Fixed in:

1.5.8

Disclosed:

May 16, 2022

CVE-2022-1409 on NVD →

[en] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 1.5.8

Fixed in:

1.5.8

Disclosed:

May 16, 2022

CVE-2022-1408 on NVD →

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 1.5.9

Fixed in:

1.5.9

Disclosed:

May 3, 2022

CVE-2022-1528 on NVD →

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a...

CVSS:

8.8

Affected:

up to 1.5.8

Fixed in:

1.5.8

Disclosed:

Apr 21, 2022

CVE-2022-1407 on NVD →

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

CVSS:

5.5

Affected:

up to 1.5.8

Fixed in:

1.5.9

Disclosed:

Apr 21, 2022

CVE-2022-1409 on NVD →

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS:

5.5

Affected:

up to 1.5.8

Fixed in:

1.5.8

Disclosed:

Apr 21, 2022

CVE-2022-1408 on NVD →

[en] Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by guessing / brute-forcing easy predictable booking IDs via search POST requests.

Affected:

up to 1.5.9

Fixed in:

1.5.9

Disclosed:

Apr 19, 2022

CVE-2022-27863 on NVD →

[en] Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.

Affected:

up to 1.5.9

Fixed in:

1.5.9

Disclosed:

Apr 19, 2022

CVE-2022-27862 on NVD →

Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.

CVSS:

9.8

Affected:

up to 1.5.3

Fixed in:

1.5.4

Disclosed:

Apr 18, 2022

CVE-2022-27862 on NVD →

Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by guessing / brute-forcing easy predictable booking IDs via search POST requests.

CVSS:

5.3

Affected:

up to 1.5.3

Fixed in:

1.5.4

Disclosed:

Apr 18, 2022

CVE-2022-27863 on NVD →