CVE-2022-1407: Vikwp Hotel Booking Engine & Pms

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack

Affected products

• Vikwp Hotel Booking Engine & Pms: before 1.5.8 (fixed in 1.5.8)

Published 2022-05-16. Last modified 2026-06-17.