CVE-2026-95684

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS versions prior to 1.8.16

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the attachments[name] parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update the plugin to version 1.8.16 or later. As a temporary mitigation, restrict or disable the use of the attachments[name] parameter until the update is applied.