VikBooking Hotel Booking Engine & PMS vulnerabilities

11 known vulnerabilities in VikBooking Hotel Booking Engine & PMS from E4jvikwp. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-93429Nov 7, 2026E4jvikwp

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This make

• 7.2 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-95684Oct 10, 2026E4jvikwp

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it

• 7.1 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-95591Oct 9, 2026E4jvikwp

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.

• 7.2 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-15401Jul 24, 2026E4jvikwp

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible

• 7.2 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-6820Jul 8, 2026E4jvikwp

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible

• 7.2 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-6818Jul 8, 2026E4jvikwp

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes

• 7.4 High severity

  VikBooking Hotel Booking Engine & PMS: Cross-Site Request Forgery

  CVE-2026-57723Jul 1, 2026E4jvikwp

  Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.

• 7.1 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-42683Jun 1, 2026E4jvikwp

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.8.

• 7.1 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation

  CVE-2026-42762May 27, 2026E4jvikwp

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows DOM-Based XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1

• 8.6 High severity

  VikBooking Hotel Booking Engine & PMS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-42737May 27, 2026E4jvikwp

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Path Traversal.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.

• 8.8 High severity

  VikBooking Hotel Booking Engine & PMS: Cross-Site Request Forgery

  CVE-2024-11641Jan 26, 2025E4jvikwp

  The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unau