Cpe:2.3:a:vikwp:vikbooking:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3avikwpvikbookingwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 10 Oct 2026 07:52:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in VikBooking WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-vikbooking-xss/Sat, 10 Oct 2026 07:52:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-vikbooking-xss/The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.15 contains a Stored XSS vulnerability in the 'attachments[name]' parameter that allows unauthenticated attackers to inject malicious scripts.The VikBooking Hotel Booking Engine & PMS plugin for WordPress, in all versions up to and including 1.8.15, is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw exists due to insufficient input sanitization and output escaping on the 'attachments[name]' parameter. Unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts into the application. When a victim, such as an administrator or another user, accesses the page where the malicious script is stored, the browser executes the script in the context of the user session. This can lead to unauthorized administrative actions, session hijacking, or redirection to malicious sites. Because the plugin is used for hotel booking management, this vulnerability poses a high risk to businesses managing guest and administrative data within the WordPress dashboard.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a legitimate user's browser session. In a WordPress environment, this typically results in account takeover, unauthorized modification of plugin settings, or exfiltration of sensitive booking data. The target scope includes any WordPress instance running vulnerable versions of VikBooking.

Recommendation

  1. Immediately update the VikBooking Hotel Booking Engine & PMS plugin to a version beyond 1.8.15.
  2. Audit WordPress dashboard access logs for suspicious POST requests targeting plugin attachment endpoints.
  3. Implement a Web Application Firewall (WAF) rule to inspect input parameters containing HTML or script tags directed at the plugin's attachment functionality.
]]>highadvisoryweb-applicationwordpressxss