What is the CVSS score of CVE-2026-15346?

CVE-2026-15346 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Vikbooking Hotel Booking Engine Pms CVE-2026-15346

EUVD-2026-48528 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-cw6g-xxqg-vwrh

WordPress XSS Vikbooking Hotel Booking Engine Pms Wordpress Plugin E4Jvikwp

6.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:22 vuln.today

CVE Published

Jul 24, 2026 - 07:53 cve.org

MEDIUM 6.1

DescriptionCVE.org

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.

AnalysisAI

Reflected cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to 1.8.13 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted link containing malicious code in the 'category_id' parameter. Exploitation requires user interaction and is limited to browsers that support access keys because the injection point is within a hidden element's accesskey attribute. EPSS indicates low exploitation probability (0.26%), and no active exploitation or public exploit code has been identified.