CVE-2026-85127
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
Risk Assessment
Attackers can upload malicious content that executes in the administrator's browser, potentially leading to session hijacking or data theft.
Recommendation
Update the VikBooking plugin to version 1.8.15 or later, which includes fixes for restricting file types and sanitizing contents.
Other vulnerabilities in VikBooking Hotel Booking Engine & PMS
See all- CVE-2026-42762High
CVE-2026-42762 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-42737High
CVE-2026-42737 describes an improper limitation of a pathname to a restricted directory, leading to a Path Traversal vulnerability in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-15401High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.13 is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts.
- CVE-2026-15346Medium
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected XSS via the 'category_id' parameter in all versions up to 1.8.13. An attacker can inject arbitrary scripts that execute when a victim clicks a link, but only in browsers supporting access keys.
- CVE-2026-6818High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-57723High
A CSRF vulnerability in VikBooking Hotel Booking Engine & PMS allows an attacker to perform operations leading to Path Traversal. This issue affects all versions up to and including 1.8.12.
- CVE-2026-12754Medium
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to and including 1.8.12 due to insufficient input sanitization and output escaping.
- CVE-2026-42683High
The VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to 1.8.8) has a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS