CVE-2026-95684— VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
Quick assessment
Affected
e4jvikwp VikBooking Hotel Booking Engine & PMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 VikBooking 酒店预订引擎与物业管理系统（PMS）插件在所有 1.8.15 及更早版本中存在存储型跨站脚本（Stored XSS）漏洞，该漏洞出现在 参数中，原因是输入清理和输出转义不足。这使得未经身份验证的攻击者可以在页面中注入任意 Web 脚本，当用户访问包含这些脚本的页面时，脚本便会执行。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95684
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| e4jvikwp | VikBooking Hotel Booking Engine & PMS | 0 ~ 1.8.15 | - |
|
II. Public POCs for CVE-2026-95684
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95684
请登录查看更多情报信息。
Other References for CVE-2026-95684 (7)
IV. Related Vulnerabilities
Same product: VikBooking Hotel Booking Engine & PMS
-
CVE-2026-95591
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1. -
CVE-2026-85127
VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via S -
CVE-2026-15401
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenti -
CVE-2026-15346
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected -
CVE-2026-6820
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthentic
Same vendor: e4jvikwp
-
CVE-2026-95591
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1. -
CVE-2026-39790
WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting -
CVE-2026-87115
VikAppointments Services Booking Calendar <= 1.2.21 - Unauth -
CVE-2026-84768
WordPress VikAppointments Services Booking Calendar plugin < -
CVE-2026-15918
VikAppointments – Services Booking Calendar <= 1.2.19 - Unau
Same weakness: CWE-79
-
CVE-2026-4791
PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticate -
CVE-2026-107657
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scri -
CVE-2026-93951
WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scrip -
CVE-2026-103478
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stor -
CVE-2026-97340
Avada | Website Builder For WordPress & WooCommerce <= 7.16.
V. Comments for CVE-2026-95684
No comments yet