Anhdung1329

**Name of the Vulnerable Software and Affected Versions** VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15 **Description** Unauthenticated visitors can attach unrestricted file types to the live chat feature. Because the plugin fails to sanitize the contents of these attachments, an attacker can store active content that executes in the context of an administrator when they view the conversation. This is a stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the server and served to other users. **Recommendations** Update the VikBooking Hotel Booking Engine & PMS WordPress plugin to version 1.8.15 or later.