vikbooking

Security Risk Profile

/100

medium

Security Risk Score

Comprehensive risk assessment based on 7 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from May 10, 2024 to present

Total CVEs

Critical+High

Exploited

Unpatched

Threat Assessment

Avg CVSS

6.7

Base severity

Avg EPSS

Exploit probability

Unpatched

Critical/High

Risk Level

53/100

medium

🆕 1Fresh (<7d)📈 1 in Last 30 Days

Severity Distribution

Critical

High

Medium

Low

Exploit Likelihood

>50% chance

20-50%

5-20%

<5%

Age Distribution

Common Weaknesses (CWE)

XSS

CSRF

Most Affected Products

1. VikBooking Hotel Booking Engine & PMS5

2. vikwp Vikbooking Hotel Booking Engine \& Pms Wordpress4

3. VikBooking VikBooking Hotel Booking Engine & PMS (WordPress plugin)1

4. VikBooking Hotel Booking Engine & PMS plugin for WordPress1

5. VikBooking VikBooking Hotel Booking Engine & PMS plugin1

Recent Vulnerabilities

See more →

CVE-2026-85127

unknown

VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment

Sep 18, 2026🔧 No Patch

CVE-2026-15401

CVSS 7.2high

VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter

Jul 24, 2026🔧 No Patch

CVE-2025-5803

CVSS 5.3medium

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerability

Nov 6, 2025🔧 No Patch

CVE-2024-13616

CVSS 4.8medium

VikBooking < 1.7.2 - Admin+ Stored XSS

May 15, 2025🔧 No Patch

CVE-2024-11641

CVSS 8.8high

VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload

Jan 26, 2025

CVE-2024-2749

CVSS 5.9medium

VikBooking < 1.6.8 - Broken Access Control

May 10, 2024🔧 No Patch

CVE-2024-2441

CVSS 8.1high

VikBooking < 1.6.8 - Insecure Direct Object References