20
CVEs
2
Critical
14
High
0
KEV
0
PoC
16
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
14
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (8)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-84768 | Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class. | CRITICAL | 9.3 | 0.2% | 46 |
No patch
|
| CVE-2026-87115 | Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program. | CRITICAL | 9.1 | 0.9% | 46 |
No patch
|
| CVE-2026-111120 | Cross-site request forgery in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.8) lets an unauthenticated attacker write arbitrary PHP into the plugin's own template files - including site/helpers/email_tmpl.php - which loadEmailTemplate() and loadPdfTemplate() later include(), achieving remote code execution on the server. The condtext_update_tmpl handler lacks a working nonce check, so the only prerequisite beyond an active plugin is luring a logged-in administrator into clicking a link or visiting a page that fires the forged request (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). It is not in CISA KEV and no public exploit code has been identified at time of analysis; Wordfence-driven triage places remediation in this week's queue rather than emergency response, and a forged request is reliable against default installs once an administrator is tricked. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-112836 | Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typically a WordPress administrator-submit unintended VikRentCar actions when tricked into visiting attacker-controlled content. The supplied CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R), but the authoritative assessment constrains realistic impact to integrity only (C:N/I:L/A:N) because the attacker cannot read responses and must rely on victim interaction. No CISA KEV entry or public exploit code was identified in the provided data. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-15918 | Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-52699 | Unauthenticated Insecure Direct Object References in the VikRentCar WordPress plugin versions 1.4.5 and earlier allow remote attackers to access sensitive resources belonging to other users by manipulating predictable object identifiers. The flaw was disclosed via Patchstack and affects WordPress sites running the e4jvikwp VikRentCar booking plugin, with no public exploit identified at time of analysis but a high CVSS confidentiality impact reflecting potential exposure of booking, customer, or reservation data. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-57723 | Arbitrary file deletion in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to and including 1.8.12) is reachable via a cross-site request forgery flaw that lets an attacker abuse a path-traversal-capable file operation. By tricking a logged-in administrator into visiting a malicious page, a remote unauthenticated attacker can forge a request that deletes arbitrary files on the WordPress host, potentially disabling the site. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided. | HIGH | 7.4 | 0.1% | 37 |
No patch
|
| CVE-2026-95684 | Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-16143 | Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-6818 | Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated attackers persist arbitrary JavaScript via the 'special_requests' booking field, which then executes when a hotel operator or user views the injected order in the admin back-end. Reported by Wordfence with a CVSS 7.2 (scope-changed) rating; no public exploit identified at time of analysis and it is not listed in CISA KEV. The fix landed in version 1.8.9, whose patched source is referenced in the advisory. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-6820 | Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated remote attackers persist arbitrary JavaScript via the 'email' parameter, which then executes in the browser of any user - including hotel staff and admins - who later views the affected page. Because the injection point is reachable without authentication and the payload is stored server-side, it enables session hijacking, admin action forgery, and content defacement against booking-management back offices. This issue is not in CISA KEV and no public exploit has been identified at time of analysis. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-39790 | VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-112835 | Reflected cross-site scripting in the VikRentCar WordPress plugin (all versions through 1.4.8) lets a remote attacker run script in a victim's browser by luring them to a crafted link that reflects unsanitized input back into a page generated by the plugin. CVSS 3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the scope change reflects that the injected script executes in the context of the hosting WordPress site rather than the vulnerable component alone. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis; Patchstack reported the issue and the vuln.today decision feed places it at 'this_week' priority. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-112838 | Stored cross-site scripting in the VikRentCar WordPress plugin through version 1.4.8 lets an attacker store a crafted payload that executes when a victim views the affected page. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the vector indicates network reachability and no required privileges, but exploitation depends on user interaction with the stored content. No public exploit is identified at time of analysis, and the available source does not specify the vulnerable input field or the exact privilege needed to inject the payload. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-25025 | VikRestaurants plugin versions up to and including 1.5.2 contain a Reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages viewed by users. The vulnerability affects the e4jvikwp VikRestaurants product, a restaurant management and booking plugin primarily used in WordPress environments. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, resulting in credential theft, session hijacking, or defacement of the restaurant website. | HIGH | 7.1 | 0.0% | 36 |
No patch
|