CVE-2022-1408

The CVE-2022-1408 pertains to the VikBooking Hotel Booking Engine & PMS WordPress plugin prior to version 1.5.8. The vulnerability arises because several settings are not properly escaped before being emitted into HTML attributes, enabling Cross-Site Scripting (XSS) by high-privilege users (e.g.,...

CVE-2022-1409

CVE-2022-1409 affects the WordPress VikBooking Hotel Booking Engine & PMS plugin prior to 1.5.8. The vulnerability arises from improper image validation in uploads, allowing high-privilege users (e.g., administrators) to upload PHP files disguised as images containing executable PHP code. This ca...

CVE-2022-1407

CVE-2022-1407 affects the VikBooking Hotel Booking Engine & PMS WordPress plugin for versions before 1.5.8. The root cause is missing CSRF validation when adding a tracking campaign and lack of escaping campaign fields in output, enabling a logged-in admin to be coerced into including XSS payload...