VikBooking Hotel Booking Engine & PMS vulnerabilities

Product

VikBooking Hotel Booking Engine & PMS

by e4jvikwp · last CVE Oct 10, 2026

CVEs

On KEV

8.6

Max CVSS

New 30D

Vulnerabilities13 In the news0 Timeline

Severity mix

Critical 0High 9Medium 4Low 0

Severity

All severities13 Critical0 High9 Medium4 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add VikBooking Hotel Booking Engine & PMS to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-42737	8.6	0%	May 27	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability Affected: through 1.8.9
CVE-2026-57723	7.4	0%	Jul 1	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability Affected: through 1.8.12
CVE-2026-95684	7.2	0%	Oct 10	VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter Affected: through 1.8.15
CVE-2026-15401	7.2	1%	Jul 24	VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter Affected: through 1.8.13
CVE-2026-6820	7.2	0%	Jul 8	VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field Affected: through 1.8.8
CVE-2026-6818	7.2	0%	Jul 8	VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter Affected: through 1.8.8
CVE-2026-95591	7.1	0%	Oct 9	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability Affected: through 1.8.14
CVE-2026-42683	7.1	0%	Jun 1	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability Affected: through 1.8.8
CVE-2026-42762	7.1	0%	May 27	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability Affected: through 1.8.9
CVE-2026-15346	6.1	0%	Jul 24	VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter Affected: through 1.8.13
CVE-2026-12754	6.1	0%	Jul 1	VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter Affected: through 1.8.12
CVE-2025-49918	5.9	0%	Dec 18	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Sensitive Data Exposure vulnerability Affected: through 1.8.2
CVE-2025-5803	5.3	0%	Nov 6	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerability Affected: through 1.8.2