Vendor
VikWP VikRentCar: Stored Cross-Site Scripting (CVE-2026-115840)
1 rule 1 TTP 1 CVEThe VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.
VikRentCar Car Rental Management System: Cross-Site Request Forgery RCE (CVE-2026-111120)
4 TTPs 2 CVEsThe VikRentCar plugin for WordPress (<= 1.4.8) contains a CSRF vulnerability in the condtext_update_tmpl function that permits unauthenticated attackers to achieve remote code execution by injecting PHP code into template files.
Stored Cross-Site Scripting in VikBooking WordPress Plugin
2 TTPs 1 CVEThe VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.15 contains a Stored XSS vulnerability in the 'attachments[name]' parameter that allows unauthenticated attackers to inject malicious scripts.
Arbitrary File Deletion in VikAppointments Services Booking Calendar
2 TTPs 1 CVEThe VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion via insufficient path validation in the extract function, which can lead to remote code execution.
Unauthenticated SQL Injection in VikAppointments WordPress Plugin
1 TTP 1 CVEThe VikAppointments Service Booking Calendar plugin for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to exfiltrate sensitive database content.