CVE-2026-95591: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates the attack can be conducted over the network with low complexity and requires no privileges, but it does require user interaction. The vulnerability is reflected XSS, so exploitation involves getting a user to interact with a crafted request or page.

Q: Are installations running version 1.8.14 affected?

Yes. The affected range includes VikBooking Hotel Booking Engine & PMS through version 1.8.14, so version 1.8.14 is affected.

Q: What is the potential impact if exploitation succeeds?

The supplied severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. An attacker may execute script in a victim's browser context after the victim interacts with the crafted content.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.

Affected Software

1 affected component

e4jvikwp VikBooking Hotel Booking Engine & PMS<=1.8.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade e4jvikwp/vikbooking to a version that resolves this vulnerability.
Fixed in 1.8.15

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates the attack can be conducted over the network with low complexity and requires no privileges, but it does require user interaction. The vulnerability is reflected XSS, so exploitation involves getting a user to interact with a crafted request or page.

Are installations running version 1.8.14 affected?

Yes. The affected range includes VikBooking Hotel Booking Engine & PMS through version 1.8.14, so version 1.8.14 is affected.

What is the potential impact if exploitation succeeds?

The supplied severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. An attacker may execute script in a victim's browser context after the victim interacts with the crafted content.

CVE-2026-95591: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are installations running version 1.8.14 affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are installations running version 1.8.14 affected?

What is the potential impact if exploitation succeeds?