WordPress Vulnerability Scanner WPSec
Vulnerabilities / VikBooking Hotel Booking Engine & PMS

VikBooking Hotel Booking Engine & PMS vulnerabilities

Advisories WPSec published for VikBooking Hotel Booking Engine & PMS. Other sources may list more. Its attack surface: VikBooking Hotel Booking Engine & PMS on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-22 WPSEC-2026-1434 VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Cross-Site Request Forgery to Booking Modification and Custom Message Sending Medium 4.3 1.8.18
2026-10-22 WPSEC-2026-1433 VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Sensitive Information Exposure via U-tec Webhook Debug Log Low 3.7 1.8.18
2026-10-21 WPSEC-2026-1408 VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Cross-Site Request Forgery to Booking Modification, Deletion and Data Export Medium 5.4 1.8.17
2026-10-21 WPSEC-2026-1407 VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Reflected Cross-Site Scripting via 'vbo_active_tab', 'vbo_lang', 'goto' and 'status' Parameters Medium 6.1 1.8.17
2026-10-21 WPSEC-2026-1406 VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Pre-Check-in Guest Fields Medium 5.4 1.8.17
2026-10-21 WPSEC-2026-1405 VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Customer Email Medium 6.1 1.8.17
2026-10-02 WPSEC-2026-0346 VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via Chat Attachment File Name High 7.2 1.8.16
2026-10-02 WPSEC-2026-0345 VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Reflected Cross-Site Scripting via Pagination Links Medium 6.1 1.8.16

License: CC BY 4.0