VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via Chat Attachment File Name
- ID
- WPSEC-2026-0346
- Plugin
- VikBooking Hotel Booking Engine & PMS (vikbooking)
- Affected
- from 1.8.8 before 1.8.16
- Remediation
- Update to 1.8.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- VikBooking Hotel Booking Engine & PMS on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-95684, on 2026-10-09.
Description
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file name of chat message attachments in versions 1.8.8 up to, and including, 1.8.15. This is due to the attachment name, which a visitor supplies when sending a message through the front-end live chat, being inserted into the chat interface's HTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the conversation, for example in the Inquiries Chat admin widget.
References
- https://wpsec.com/vuln/WPSEC-2026-0346/
- https://plugins.svn.wordpress.org/vikbooking/tags/1.8.16/
- https://wordpress.org/plugins/vikbooking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS