VikBooking WordPress Plugin <=1.8.14 Moderate XSS Vulnerability Advisory

Vulnerability Overview Vulnerability Name: Medium-priority Cross-Site Scripting (XSS) vulnerability in WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.8.14. Vulnerability Type: Cross-Site Scripting (XSS). Priority: Medium. Impact Scope Affected Versions: <= 1.8.14. Fixed Versions: 1.8.15 and later. Risk Description: This vulnerability could be exploited in large-scale attacks, allowing attackers to inject malicious scripts to steal visitor data or hijack user accounts. Remediation 1. Update the Plugin Immediately: Update VikBooking Hotel Booking Engine & PMS Plugin to version 1.8.15 or later. 2. Use Patchstack for Automatic Mitigation: Patchstack has released mitigation rules that can block any attack attempts before updating to the patched version. 3. Contact Support: If you cannot update the plugin yourself, contact your hosting provider or website developer for assistance. Additional Information Reporter: neurotx Report Date: September 8, 2026 Publication Date: October 3, 2026 Supplementary Notes User Interaction Requirement: Successful exploitation of this vulnerability requires privileged user interaction, such as clicking a malicious link, visiting a spoofed page, or submitting a form. CVSS Score: The CVSS score for this vulnerability is 7.1, indicating a medium severity level. Code Block POC/Exploit Code: No specific POC code or exploit code was provided on the page. --- Summary: This is a medium-priority Cross-Site Scripting (XSS) vulnerability affecting versions <= 1.8.14 of the WordPress VikBooking Hotel Booking Engine & PMS Plugin. It is recommended to update to version 1.8.15 or later, or to use Patchstack's automatic mitigation feature.

Goal Reached Thanks to every supporter — we hit 100%!

VikBooking WordPress Plugin <=1.8.14 Moderate XSS Vulnerability Advisory

More from this source