TI-2024-12657 Aliases CVE-2024-13616 GHSA-7wxh-2hv2-977q

VikBooking < 1.7.2 - Admin+ Stored XSS

MEDIUM 55CWE-79Published 2025-05-15 · Updated 2025-05-20

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00326 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed VikBooking Hotel Booking Engine & PMS (Unknown): 1.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	VikBooking Hotel Booking Engine & PMS	before 1.7.2	1.7.2	Patch available	CNA

VikBooking Hotel Booking Engine & PMS VendorUnknown Affected before 1.7.2 Fixed in 1.7.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms::::::wordpress::*	before 1.7.2	Vulnerable	Vikwp

cpe:2.3:a:vikwp:vikbooking_hotel_booking_engine_\&_pms:*:*:*:*:*:wordpress:*:* Versions before 1.7.2 Vulnerable ·Vikwp

Remediation

Fix · CNA VikBooking Hotel Booking Engine & PMS (Unknown) Fixed in 1.7.2

Timeline

2026-10-02 Threatist record created from CVE-2024-13616
2026-10-03 Alias added: GHSA-7wxh-2hv2-977q

References

Exploit 1

https://wpscan.com/vulnerability/44b3a2d9-a2e1-43dd-b27a-1ad9d6015c9b/

TI-2024-02561 VikBooking < 1.6.8 - Broken Access Control CVSS 3.1MEDIUM 5.9
TI-2024-10787 Cross-site request forgery in e4jvikwp VikBooking Hotel Booking Engine & PMS CVSS 3.1HIGH 8.8
TI-2023-15783 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2023-10983 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2024-02267 VikBooking < 1.6.8 - Insecure Direct Object References CVSS 3.1HIGH 8.1
TI-2023-10018 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences