VikBooking <=1.8.13 Unauthenticated Stored XSS via vbfX (CVE-2026-15401)

Vulnerability Overview Vulnerability Name: VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter CVE ID: CVE-2026-15401 CVSS Score: 7.2 (High) Publish Date: July 23, 2026 Last Update Date: July 24, 2026 Researchers: Wordfence PRISM - Wordfence Affected Scope Software Type: Plugin Software Name: VikBooking Hotel Booking Engine & PMS Affected Versions: <= 1.8.13 Fixed Version: 1.8.14 Remediation Remediation Advice: Update to version 1.8.14 or later patched versions. Vulnerability Description The VikBooking Hotel Booking Engine & PMS plugin contains a stored Cross-Site Scripting (XSS) vulnerability. Attackers can inject malicious scripts via the parameter, causing malicious code to execute when unauthorized users access the affected pages. This vulnerability occurs in a public save task that lacks capability or authentication checks, allowing completely unauthenticated submission of malicious payloads. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Related Vulnerabilities: The page lists other related vulnerabilities for VikBooking Hotel Booking Engine & PMS, including reflected XSS, unauthenticated stored XSS, cross-site request forgery, etc. Summary The VikBooking Hotel Booking Engine & PMS plugin has a stored Cross-Site Scripting vulnerability affecting versions <= 1.8.13. Users are advised to update to version 1.8.14 or higher as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

VikBooking <=1.8.13 Unauthenticated Stored XSS via vbfX (CVE-2026-15401)

More from this source