WordPress plugin
VikBooking Hotel Booking Engine & PMS security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 39 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High12
- Medium25
- Low0
All VikBooking Hotel Booking Engine & PMS vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter
≤1.8.17Update to 1.8.18
- High7.2Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
≤1.8.15Update to 1.8.16
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.14Update to 1.8.15
- High7.21.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
1.8.8 – 1.8.14Update to 1.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
≤1.8.13Update to 1.8.14
- High7.2Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field
≤1.8.8Update to 1.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter
≤1.8.8Update to 1.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.9Update to 1.8.10
- Critical9.1Unauthenticated Arbitrary File Deletion
≤1.8.10Update to 1.8.11
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.8Update to 1.8.9
- High7.5Unauthenticated Information Exposure
≤1.8.2Update to 1.8.3
- High8.8Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload
≤1.7.2Update to 1.7.3
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
<1.5.8Update to 1.5.8
- Critical9.8Arbitrary File Upload
≤1.5.3Update to 1.5.4
VikBooking Hotel Booking Engine & PMS: common questions
Does VikBooking Hotel Booking Engine & PMS have known vulnerabilities?
Yes. VulnCrest Radar lists 39 known vulnerabilities in VikBooking Hotel Booking Engine & PMS: 2 critical, 12 high, 25 medium. None are known to affect version null.
How do I check which version of VikBooking Hotel Booking Engine & PMS I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent VikBooking Hotel Booking Engine & PMS vulnerability?
CVE-2026-93429, published Nov 6, 2026: VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter. Severity: High (CVSS 7.2).
Is any VikBooking Hotel Booking Engine & PMS vulnerability listed in CISA KEV?
No. None of the known VikBooking Hotel Booking Engine & PMS vulnerabilities is currently listed in the CISA KEV catalog.