VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

VikBooking Hotel Booking Engine & PMS security & vulnerabilities

vikbooking— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 39 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
39Known vulnerabilities
  • Critical2
  • High12
  • Medium25
  • Low0
Vulnerabilities per year
2022: 6 vulnerabilities6222023: 12 vulnerabilities12232024: 3 vulnerabilities3242025: 5 vulnerabilities5252026: 13 vulnerabilities1326

All VikBooking Hotel Booking Engine & PMS vulnerabilities

VikBooking Hotel Booking Engine & PMS vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter
≤1.8.17Update to 1.8.18
CVE-2026-93429
High7.2Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
≤1.8.15Update to 1.8.16
CVE-2026-95684
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.14Update to 1.8.15
CVE-2026-95591
High7.21.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
1.8.8 – 1.8.14Update to 1.8.15
CVE-2026-85127
High7.2Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
≤1.8.13Update to 1.8.14
CVE-2026-15401
Medium6.1Reflected Cross-Site Scripting via 'category_id' Parameter
≤1.8.13Update to 1.8.14
CVE-2026-15346
High7.2Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field
≤1.8.8Update to 1.8.9
CVE-2026-6820
High7.2Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter
≤1.8.8Update to 1.8.9
CVE-2026-6818
Medium4.3Cross-Site Request Forgery
≤1.8.12Update to 1.8.13
CVE-2026-57723
Medium6.1Reflected Cross-Site Scripting via 'layoutstyle' Parameter
≤1.8.12Update to 1.8.13
CVE-2026-12754
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.9Update to 1.8.10
CVE-2026-42762
Critical9.1Unauthenticated Arbitrary File Deletion
≤1.8.10Update to 1.8.11
CVE-2026-42737
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.8Update to 1.8.9
CVE-2026-42683
High7.5Unauthenticated Information Exposure
≤1.8.2Update to 1.8.3
CVE-2025-49918
Medium5.3Missing Authorization
≤1.8.2Update to 1.8.3
CVE-2025-5803
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.7.1Update to 1.7.2
CVE-2024-13616
Medium4.3Cross-Site Request Forgery to Settings Update
≤1.7.2Update to 1.7.3
CVE-2025-22670
High8.8Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload
≤1.7.2Update to 1.7.3
CVE-2024-11641
Medium5.4Missing Authorization
≤1.6.7Update to 1.6.8
CVE-2024-2749
Medium4.3Insecure Direct Object Reference to Menu Access
≤1.6.7Update to 1.6.8
CVE-2024-2441
Medium6.1Reflected Cross-Site Scripting
≤1.6.7Update to 1.6.8
CVE-2024-32563
Medium4.3Cross-Site Request Forgery in exec_multitask_widgets function
≤1.5.12Update to 1.6.0
—
Medium4.3Cross-Site Request Forgery in multiple functions in admin/controller.php
≤1.6.1Update to 1.6.2
—
Medium5.4Cross-Site Request Forgery in saveconfig function
≤1.5.12Update to 1.6.0
—
Medium5.4Cross-Site Request Forgery in savetmplfile function
≤1.5.12Update to 1.6.0
—
Medium4.3Cross-Site Request Forgery in admin_widgets_welcome function
≤1.5.12Update to 1.6.0
—
Medium4.3Cross-Site Request Forgery in listenTosFieldSavingTask function
≤1.6.1Update to 1.6.2
CVE-2023-32501
Medium4.3Cross-Site Request Forgery in widgets_watch_data function
≤1.5.12Update to 1.6.0
—
Medium4.3Cross-Site Request Forgery in exec_admin_widget function
≤1.5.12Update to 1.6.0
—
Medium5.4Cross-Site Request Forgery in savetranslation function
≤1.5.12Update to 1.6.0
—
Medium5.4Cross-Site Request Forgery in savetranslationstay function
≤1.5.12Update to 1.6.0
—
Medium5.3Cross-Site Request Forgery in save_admin_widgets function
≤1.5.12Update to 1.6.0
CVE-2023-25707
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
<1.5.12Update to 1.5.12
CVE-2023-24396
Medium6.1Reflected Cross-Site Scripting
<1.5.9Update to 1.5.9
CVE-2022-1528
Medium5.5Arbitrary File Upload
<1.5.8Update to 1.5.9
CVE-2022-1409
Medium5.5Admin+ Stored Cross-Site Scripting
<1.5.8Update to 1.5.8
CVE-2022-1408
High8.8 Cross-Site Request Forgery to Stored Cross-Site Scripting
<1.5.8Update to 1.5.8
CVE-2022-1407
Critical9.8Arbitrary File Upload
≤1.5.3Update to 1.5.4
CVE-2022-27862
Medium5.3Sensitive Information Exposure
≤1.5.3Update to 1.5.4
CVE-2022-27863

VikBooking Hotel Booking Engine & PMS: common questions

Does VikBooking Hotel Booking Engine & PMS have known vulnerabilities?

Yes. VulnCrest Radar lists 39 known vulnerabilities in VikBooking Hotel Booking Engine & PMS: 2 critical, 12 high, 25 medium. None are known to affect version null.

How do I check which version of VikBooking Hotel Booking Engine & PMS I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent VikBooking Hotel Booking Engine & PMS vulnerability?

CVE-2026-93429, published Nov 6, 2026: VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter. Severity: High (CVSS 7.2).

Is any VikBooking Hotel Booking Engine & PMS vulnerability listed in CISA KEV?

No. None of the known VikBooking Hotel Booking Engine & PMS vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?