CVE-2024-2441

CVE-2024-2441 (VikBooking plugin) : The VikBooking Hotel Booking Engine & PMS for WordPress (before 1.6.8) suffers an insecure direct object reference (IDOR) flaw in its access control, allowing an authenticated user with subscriber privileges or higher to directly access menus and plugin setting...

CVE-2024-2749

The CVE-2024-2749 entry applies to VikBooking Hotel Booking Engine & PMS for WordPress (versions before 1.6.8). The issue is Broken Access Control: the plugin’s settings are not properly restricted, allowing any user who can access the plugin’s menu to manipulate requests and perform unauthorized...

CVE-2024-11641

CVE-2024-11641 affects the VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions ≤ 1.7.2). The issue is a Cross-Site Request Forgery vulnerability caused by missing or incorrect nonce validation on the plugin’s save function. This can allow unauthenticated attackers with subscriber...

CVE-2023-25707

CVE-2023-25707: Cross-Site Request Forgery in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions

CVE-2023-24396

CVE-2023-24396 affects the WordPress VikBooking Hotel Booking Engine & PMS plugin, versions 1.5.11 is recommended. Other sources corroborate XSS risk in affected versions and suggest patching as the mitigation. If exploiting details are not provided in the documents, note that exploitation specif...

CVE-2023-32501

The CVE-2023-32501 entry concerns the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions

CVE-2024-13616

The CVE covers the VikBooking Hotel Booking Engine & PMS WordPress plugin (prior to version 1.7.2). The underlying issue is insufficient sanitization/escaping of certain plugin settings, enabling Stored Cross-Site Scripting even when unfiltered_html is disallowed (e.g., in multisite setups). Affe...