WordPress VikBooking plugin < 1.7.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions 1.7.2...

CVE-2024-13616 VikBooking < 1.7.2 - Admin+ Stored XSS

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-13616

The CVE covers the VikBooking Hotel Booking Engine & PMS WordPress plugin (prior to version 1.7.2). The underlying issue is insufficient sanitization/escaping of certain plugin settings, enabling Stored Cross-Site Scripting even when unfiltered_html is disallowed (e.g., in multisite setups). Affe...