CVE-2026-87115

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2026-87115 VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2026-87115

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 1.2.21 . The root cause is insufficient file path validation within the extract function, specifically involving the old_vapcfN parameter...

EUVD-2026-91958

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.21 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by zickzick2 in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.21...

CVE-2026-84768

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

CVE-2026-84768

CVE-2026-84768 affects the WordPress VikAppointments Services Booking Calendar plugin in versions 1.2.20 and earlier . The vulnerability is an unauthenticated SQL Injection , meaning an attacker can exploit it without prior access or credentials. The CVSS 3.1 base score is 9.3 (CRITICAL) , with a...

CVE-2026-84768 WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

EUVD-2026-70578

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

CVE-2026-84768 WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.20...

CVE-2026-84768: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

PT-2026-85108

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.19 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.19...

CVE-2026-15918

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

CVE-2026-15918

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

CVE-2026-15918

The CVE describes a SQL injection in the VikAppointments WordPress plugin (versions

CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

EUVD-2026-53038

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...