Plugin security history

VikBooking Hotel Booking Engine & PMS Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 35 vulnerability records associated with VikBooking Hotel Booking Engine & PMS, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

35Total records

2Critical

8High

25Medium

0Low

0Informational

35Patched records

0Currently marked unpatched

2022-04-18First disclosure

2026-07-23Latest disclosure

35 of 35CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	6	6 records
2023	12	12 records
2024	3	3 records
2025	5	5 records
2026	9	9 records

Severity Breakdown

Severity	Records	Share
Critical	2	5.7%
High	8	22.9%
Medium	25	71.4%

Vulnerability-Type Breakdown

CSRF

15 records42.9%

First: 2022. Latest: 2026.

Cross-Site Scripting

12 records34.3%

First: 2022. Latest: 2026.

Missing Authorization

3 records8.6%

First: 2024. Latest: 2025.

Arbitrary File Upload

2 records5.7%

First: 2022. Latest: 2022.

Information Disclosure

2 records5.7%

First: 2022. Latest: 2025.

Path Traversal

1 record2.9%

First: 2026. Latest: 2026.

Patch Status

Patched: 35
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.8.14
1.8.9
1.8.13
1.8.10
1.8.11
1.8.3
1.7.2
1.7.3
1.6.8
1.6.2
1.6.0
1.5.12
1.5.9
1.5.8
1.5.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.8.13`	VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter	July 23, 2026	1.8.14	High
`*-1.8.13`	VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter	July 23, 2026	1.8.14	Medium
`*-1.8.8`	VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field	July 7, 2026	1.8.9	High
`*-1.8.8`	VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter	July 7, 2026	1.8.9	High
`*-1.8.12`	VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Cross-Site Request Forgery	July 1, 2026	1.8.13	Medium
`*-1.8.12`	VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter	June 30, 2026	1.8.13	Medium
`*-1.8.9`	VikBooking Hotel Booking Engine & PMS <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting	June 1, 2026	1.8.10	High
`*-1.8.10`	VikBooking Hotel Booking Engine & PMS <= 1.8.10 - Unauthenticated Arbitrary File Deletion	May 27, 2026	1.8.11	Critical
`*-1.8.8`	VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting	May 20, 2026	1.8.9	High
`*-1.8.2`	VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Unauthenticated Information Exposure	November 7, 2025	1.8.3	High
`*-1.8.2`	VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Missing Authorization	October 21, 2025	1.8.3	Medium
`*-1.7.1`	VikBooking Hotel Booking Engine & PMS <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting	March 3, 2025	1.7.2	Medium
`*-1.7.2`	VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Settings Update	February 3, 2025	1.7.3	Medium
`*-1.7.2`	VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload	January 25, 2025	1.7.3	High
`*-1.6.7`	VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Missing Authorization	April 19, 2024	1.6.8	Medium
`*-1.6.7`	VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Insecure Direct Object Reference to Menu Access	April 19, 2024	1.6.8	Medium
`*-1.6.7`	VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Reflected Cross-Site Scripting	April 16, 2024	1.6.8	Medium
`*-1.5.12`	VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in save_admin_widgets function	February 15, 2023	1.6.0	Medium
`*-1.5.12`	VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in savetranslationstay function	February 15, 2023	1.6.0	Medium
`*-1.5.12`	VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in savetranslation function	February 15, 2023	1.6.0	Medium
`*-1.5.12`	VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in exec_admin_widget function	February 15, 2023	1.6.0	Medium
`*-1.5.12`	VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in widgets_watch_data function	February 15, 2023	1.6.0	Medium
`*-1.6.1`	VikBooking Hotel Booking Engine & PMS <= 1.6.1 - Cross-Site Request Forgery in listenTosFieldSavingTask function	February 15, 2023	1.6.2	Medium
`*-1.5.12`	VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in exec_multitask_widgets function	February 15, 2023	1.6.0	Medium
`*-1.5.12`	VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in savetmplfile function	February 15, 2023	1.6.0	Medium

Selected source records

Latest Records

HighCVE-2026-15401

VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter

Published: July 23, 2026

Affected versions: *-1.8.13
Patched versions: 1.8.14

Original Wordfence record

MediumCVE-2026-15346

VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter

Published: July 23, 2026

Affected versions: *-1.8.13
Patched versions: 1.8.14

Original Wordfence record

HighCVE-2026-6820

VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field

Published: July 7, 2026

Affected versions: *-1.8.8
Patched versions: 1.8.9

Original Wordfence record

HighCVE-2026-6818

VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter

Published: July 7, 2026

Affected versions: *-1.8.8
Patched versions: 1.8.9

Original Wordfence record

MediumCVE-2026-57723

VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Cross-Site Request Forgery

Published: July 1, 2026

Affected versions: *-1.8.12
Patched versions: 1.8.13

Original Wordfence record

MediumCVE-2026-12754

VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter

Published: June 30, 2026

Affected versions: *-1.8.12
Patched versions: 1.8.13

Original Wordfence record

HighCVE-2026-42762

VikBooking Hotel Booking Engine & PMS <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting

Published: June 1, 2026

Affected versions: *-1.8.9
Patched versions: 1.8.10

Original Wordfence record

CriticalCVE-2026-42737

VikBooking Hotel Booking Engine & PMS <= 1.8.10 - Unauthenticated Arbitrary File Deletion

Published: May 27, 2026

Affected versions: *-1.8.10
Patched versions: 1.8.11

Original Wordfence record

Highest-Severity Records

CriticalCVE-2022-27862

VikBooking Hotel Booking Engine & PMS <= 1.5.3 - Arbitrary File Upload

Published: April 18, 2022

Affected versions: *-1.5.3
Patched versions: 1.5.4

Original Wordfence record

CriticalCVE-2026-42737

VikBooking Hotel Booking Engine & PMS <= 1.8.10 - Unauthenticated Arbitrary File Deletion

Published: May 27, 2026

Affected versions: *-1.8.10
Patched versions: 1.8.11

Original Wordfence record

HighCVE-2022-1407

VikBooking Hotel Booking Engine & PMS <= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published: April 21, 2022

Affected versions: [*, 1.5.8)
Patched versions: 1.5.8

Original Wordfence record

HighCVE-2024-11641

VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload

Published: January 25, 2025

Affected versions: *-1.7.2
Patched versions: 1.7.3

Original Wordfence record

HighCVE-2025-49918

VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Unauthenticated Information Exposure

Published: November 7, 2025

Affected versions: *-1.8.2
Patched versions: 1.8.3

Original Wordfence record

HighCVE-2026-15401

VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter

Published: July 23, 2026

Affected versions: *-1.8.13
Patched versions: 1.8.14

Original Wordfence record

HighCVE-2026-6818

VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter

Published: July 7, 2026

Affected versions: *-1.8.8
Patched versions: 1.8.9

Original Wordfence record

HighCVE-2026-42762

VikBooking Hotel Booking Engine & PMS <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting

Published: June 1, 2026

Affected versions: *-1.8.9
Patched versions: 1.8.10

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory