WordPress VikBooking plugin < 1.7.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions 1.7.2...

CVE-2024-13616 VikBooking < 1.7.2 - Admin+ Stored XSS

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-13616

The VikBooking Hotel Booking Engine & PMS WordPress plugin, in versions prior to 1.7.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of certain plugin settings. This allows high-privilege users , such as administrators, to perf...