CVE-2026-15346
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected XSS via the 'category_id' parameter in all versions up to 1.8.13. An attacker can inject arbitrary scripts that execute when a victim clicks a link, but only in browsers supporting access keys.
Risk Assessment
The risk involves execution of malicious scripts in the browser of an admin or user, potentially leading to session theft, redirects, or data theft.
Recommendation
Immediately update the plugin to the latest patched version and consider using WAF rules to block suspicious parameters.
Other vulnerabilities in VikBooking Hotel Booking Engine & PMS
See all- CVE-2026-42762High
CVE-2026-42762 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-42737High
CVE-2026-42737 describes an improper limitation of a pathname to a restricted directory, leading to a Path Traversal vulnerability in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-15401High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.13 is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts.
- CVE-2026-6818High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-57723High
A CSRF vulnerability in VikBooking Hotel Booking Engine & PMS allows an attacker to perform operations leading to Path Traversal. This issue affects all versions up to and including 1.8.12.
- CVE-2026-12754Medium
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to and including 1.8.12 due to insufficient input sanitization and output escaping.
- CVE-2026-42683High
The VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to 1.8.8) has a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.