TI-2022-01401 Aliases CVE-2022-1528 GHSA-6fm6-9j5g-vf3g

VikBooking < 1.5.9 - Reflected Cross-Site Scripting

LOW 29CWE-79Published 2022-05-30 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting

Why it matters now

EPSS 0.008 56th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed VikBooking Hotel Booking Engine & PMS (Unknown): 1.5.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	VikBooking Hotel Booking Engine & PMS	1.5.0 and later; 1.5.9 to before 1.5.9	1.5.9	Patch available	CNA

VikBooking Hotel Booking Engine & PMS VendorUnknown Affected 1.5.0 and later; 1.5.9 to before 1.5.9 Fixed in 1.5.9 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vikwp:vik_booking::::::wordpress::*	before 1.5.9	Vulnerable	Vikwp

cpe:2.3:a:vikwp:vik_booking:*:*:*:*:*:wordpress:*:* Versions before 1.5.9 Vulnerable ·Vikwp

Remediation

Fix · CNA VikBooking Hotel Booking Engine & PMS (Unknown) Fixed in 1.5.9

Timeline

2026-10-02 Threatist record created from CVE-2022-1528
2026-10-03 Alias added: GHSA-6fm6-9j5g-vf3g

References

Exploit 1

https://wpscan.com/vulnerability/d1e59894-382f-4151-8c4c-5608f3d8ac1f

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences