Threat Investigation
Request a demo

CVE-2022-1407

Medium

Description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack

SeverityMedium
CVSS6.5
Exploit probability—
ProductVikwp Hotel Booking Engine \& Pms
PublishedMay 16, 2022
First seenMay 16, 2022
Weakness typeCWE-352Cross-site request forgery (CSRF)

How to fix

Update
  • vikwp hotel_booking_engine_\&_pms1.5.8 or later

Affected products

ProductAffected versionsFixed in
vikwp hotel_booking_engine_\&_pmsv < 1.5.81.5.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.