E4Jvikwp

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-84768	Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class.	CRITICAL	9.3	0.2%	46	No patch
CVE-2026-87115	Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.	CRITICAL	9.1	0.9%	46	No patch
CVE-2026-111120	Cross-site request forgery in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.8) lets an unauthenticated attacker write arbitrary PHP into the plugin's own template files - including site/helpers/email_tmpl.php - which loadEmailTemplate() and loadPdfTemplate() later include(), achieving remote code execution on the server. The condtext_update_tmpl handler lacks a working nonce check, so the only prerequisite beyond an active plugin is luring a logged-in administrator into clicking a link or visiting a page that fires the forged request (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). It is not in CISA KEV and no public exploit code has been identified at time of analysis; Wordfence-driven triage places remediation in this week's queue rather than emergency response, and a forged request is reliable against default installs once an administrator is tricked.	HIGH	8.8	0.3%	44	No patch
CVE-2026-112836	Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typically a WordPress administrator-submit unintended VikRentCar actions when tricked into visiting attacker-controlled content. The supplied CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R), but the authoritative assessment constrains realistic impact to integrity only (C:N/I:L/A:N) because the attacker cannot read responses and must rely on victim interaction. No CISA KEV entry or public exploit code was identified in the provided data.	HIGH	8.8	0.2%	44	No patch
CVE-2026-15918	Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.	HIGH	7.5	0.4%	38	No patch
CVE-2026-95684	Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself.	HIGH	7.2	0.2%	36	No patch
CVE-2026-16143	Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.	HIGH	7.2	0.2%	36	No patch
CVE-2026-39790	VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.	HIGH	7.1	0.3%	36	No patch
CVE-2026-112835	Reflected cross-site scripting in the VikRentCar WordPress plugin (all versions through 1.4.8) lets a remote attacker run script in a victim's browser by luring them to a crafted link that reflects unsanitized input back into a page generated by the plugin. CVSS 3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the scope change reflects that the injected script executes in the context of the hosting WordPress site rather than the vulnerable component alone. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis; Patchstack reported the issue and the vuln.today decision feed places it at 'this_week' priority.	HIGH	7.1	0.1%	36	No patch
CVE-2026-112838	Stored cross-site scripting in the VikRentCar WordPress plugin through version 1.4.8 lets an attacker store a crafted payload that executes when a victim views the affected page. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the vector indicates network reachability and no required privileges, but exploitation depends on user interaction with the stored content. No public exploit is identified at time of analysis, and the available source does not specify the vulnerable input field or the exact privilege needed to inject the payload.	HIGH	7.1	0.1%	36	No patch
CVE-2026-95591	Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.	HIGH	7.1	0.2%	36	No patch
CVE-2026-116750	Blind SQL injection in the VikRentCar Car Rental Management System WordPress plugin through version 1.4.10 lets an authenticated attacker with contributor-level access or above append arbitrary SQL to the plugin's own queries and extract sensitive database contents - user credentials, session tokens, and other stored data - one bit at a time. The injection point is the 'catid' attribute of the plugin's cars module widget, and the notable twist is the delivery path: the payload is planted as a malicious Gutenberg block in a pending post through the REST API and then rendered server-side when the attacker previews that post, which sidesteps wp_magic_quotes because the attribute is read from post_content via parse_blocks instead of a superglobal. Wordfence reports it, no public exploit code is identified at time of analysis and there is no CISA KEV listing; impact is confidentiality-only, and exploitation requires an existing contributor account, so this is a this-month priority rather than an emergency.	MEDIUM	6.5	0.3%	32	No patch
CVE-2026-116749	Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.10) allows an authenticated attacker holding contributor-level access or higher to plant arbitrary script in the plugin's 'className' widget parameter, which then runs in the browser of any user who loads the injected page. The payload survives save-time sanitization because the injection lands in an HTML-attribute context where a raw double-quote is enough to break out, and the block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time, so wp_kses_post() does not neutralize it. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as EUVD-2026-111596; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places it in the this_month remediation queue rather than an emergency.	MEDIUM	6.4	0.2%	32	No patch

CVE-2026-84768

Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class.

CRITICAL

9.3

0.2%

46

No patch

CVE-2026-87115

Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.

CRITICAL

9.1

0.9%

46

No patch

CVE-2026-111120

Cross-site request forgery in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.8) lets an unauthenticated attacker write arbitrary PHP into the plugin's own template files - including site/helpers/email_tmpl.php - which loadEmailTemplate() and loadPdfTemplate() later include(), achieving remote code execution on the server. The condtext_update_tmpl handler lacks a working nonce check, so the only prerequisite beyond an active plugin is luring a logged-in administrator into clicking a link or visiting a page that fires the forged request (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). It is not in CISA KEV and no public exploit code has been identified at time of analysis; Wordfence-driven triage places remediation in this week's queue rather than emergency response, and a forged request is reliable against default installs once an administrator is tricked.

HIGH

8.8

0.3%

44

No patch

CVE-2026-112836

Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typically a WordPress administrator-submit unintended VikRentCar actions when tricked into visiting attacker-controlled content. The supplied CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R), but the authoritative assessment constrains realistic impact to integrity only (C:N/I:L/A:N) because the attacker cannot read responses and must rely on victim interaction. No CISA KEV entry or public exploit code was identified in the provided data.

HIGH

8.8

0.2%

44

No patch

CVE-2026-15918

Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.

HIGH

7.5

0.4%

38

No patch

CVE-2026-95684

Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself.

HIGH

7.2

0.2%

36

No patch

CVE-2026-16143

Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.

HIGH

7.2

0.2%

36

No patch

CVE-2026-39790

VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.

HIGH

7.1

0.3%

36

No patch

CVE-2026-112835

Reflected cross-site scripting in the VikRentCar WordPress plugin (all versions through 1.4.8) lets a remote attacker run script in a victim's browser by luring them to a crafted link that reflects unsanitized input back into a page generated by the plugin. CVSS 3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the scope change reflects that the injected script executes in the context of the hosting WordPress site rather than the vulnerable component alone. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis; Patchstack reported the issue and the vuln.today decision feed places it at 'this_week' priority.

HIGH

7.1

0.1%

36

No patch

CVE-2026-112838

Stored cross-site scripting in the VikRentCar WordPress plugin through version 1.4.8 lets an attacker store a crafted payload that executes when a victim views the affected page. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the vector indicates network reachability and no required privileges, but exploitation depends on user interaction with the stored content. No public exploit is identified at time of analysis, and the available source does not specify the vulnerable input field or the exact privilege needed to inject the payload.

HIGH

7.1

0.1%

36

No patch

CVE-2026-95591

Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.

HIGH

7.1

0.2%

36

No patch

CVE-2026-116750

Blind SQL injection in the VikRentCar Car Rental Management System WordPress plugin through version 1.4.10 lets an authenticated attacker with contributor-level access or above append arbitrary SQL to the plugin's own queries and extract sensitive database contents - user credentials, session tokens, and other stored data - one bit at a time. The injection point is the 'catid' attribute of the plugin's cars module widget, and the notable twist is the delivery path: the payload is planted as a malicious Gutenberg block in a pending post through the REST API and then rendered server-side when the attacker previews that post, which sidesteps wp_magic_quotes because the attribute is read from post_content via parse_blocks instead of a superglobal. Wordfence reports it, no public exploit code is identified at time of analysis and there is no CISA KEV listing; impact is confidentiality-only, and exploitation requires an existing contributor account, so this is a this-month priority rather than an emergency.

MEDIUM

6.5

0.3%

32

No patch

CVE-2026-116749

Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.10) allows an authenticated attacker holding contributor-level access or higher to plant arbitrary script in the plugin's 'className' widget parameter, which then runs in the browser of any user who loads the injected page. The payload survives save-time sanitization because the injection lands in an HTML-attribute context where a raw double-quote is enough to break out, and the block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time, so wp_kses_post() does not neutralize it. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as EUVD-2026-111596; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places it in the this_month remediation queue rather than an emergency.

MEDIUM

6.4

0.2%

32

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (8)

Top Risky CVEs