CVE-2024-2441

The VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.6.8 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. This security issue stems from a failure in the access control mechanism, which allows authenticated users with subscriber privileges or higher to d...

CVE-2024-2749

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categori...

CVE-2024-11641

CVE-2024-11641 affects the VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions ≤ 1.7.2). The issue is a Cross-Site Request Forgery vulnerability caused by missing or incorrect nonce validation on the plugin’s save function. This can allow unauthenticated attackers with subscriber...

CVE-2023-25707

CVE-2023-25707: Cross-Site Request Forgery in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions

CVE-2023-24396

CVE-2023-24396 affects the WordPress VikBooking Hotel Booking Engine & PMS plugin, versions 1.5.11 is recommended. Other sources corroborate XSS risk in affected versions and suggest patching as the mitigation. If exploiting details are not provided in the documents, note that exploitation specif...

CVE-2023-32501

The CVE-2023-32501 entry concerns the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions

CVE-2024-13616

The VikBooking Hotel Booking Engine & PMS WordPress plugin, in versions prior to 1.7.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of certain plugin settings. This allows high-privilege users , such as administrators, to perf...