CVE-2026-95684
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to stored XSS via the 'attachments[name]' parameter in all versions up to and including 1.8.15.
Risk Assessment
An unauthenticated attacker can inject arbitrary scripts that execute when a user visits an infected page, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the VikBooking plugin to the latest version that includes a security fix.
Other vulnerabilities in VikBooking Hotel Booking Engine & PMS
See all- CVE-2026-95591High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a Reflected XSS vulnerability in versions up to and including 1.8.14. The vulnerability allows an attacker to inject malicious JavaScript into the page.
- CVE-2026-42762High
CVE-2026-42762 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-42737High
CVE-2026-42737 describes an improper limitation of a pathname to a restricted directory, leading to a Path Traversal vulnerability in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-85127High
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
- CVE-2026-15401High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.13 is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts.
- CVE-2026-15346Medium
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected XSS via the 'category_id' parameter in all versions up to 1.8.13. An attacker can inject arbitrary scripts that execute when a victim clicks a link, but only in browsers supporting access keys.
- CVE-2026-6818High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-57723High
A CSRF vulnerability in VikBooking Hotel Booking Engine & PMS allows an attacker to perform operations leading to Path Traversal. This issue affects all versions up to and including 1.8.12.
- CVE-2026-12754Medium
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to and including 1.8.12 due to insufficient input sanitization and output escaping.
- CVE-2026-42683High
The VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to 1.8.8) has a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS