Is CVE-2026-15401 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15401 being exploited in the wild.

How severe is CVE-2026-15401?

High severity, with a CVSS score of 7.2, published 24 July 2026.

Which products and versions are affected?

e4jvikwp VikBooking Hotel Booking Engine & PMS up to, and including, 1.8.13.

Is there a fix for CVE-2026-15401?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15401 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15401?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15401: VikBooking Hotel Booking Engine & PMS Stored XSS in vbfX parameter

CVE-2026-15401 · Severity: high · CVSS 7.2 · Published 2026-07-24

VikBooking is a WordPress plugin used by hotels to manage room bookings and property management tasks. A security flaw allows unauthorized individuals to inject malicious scripts into the booking system, which could lead to the theft of customer data or administrative session hijacking when staff view booking details. This vulnerability is particularly serious because it requires no login or special permissions to exploit.

Quick answers

Is CVE-2026-15401 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15401 being exploited in the wild.
How severe is CVE-2026-15401?: High severity, with a CVSS score of 7.2, published 24 July 2026.
Which products and versions are affected?: e4jvikwp VikBooking Hotel Booking Engine & PMS up to, and including, 1.8.13.
Is there a fix for CVE-2026-15401?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15401 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15401?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The VikBooking Hotel Booking Engine & PMS plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input sanitization and output escaping on the 'vbfX' parameter. The root cause is located in the public-facing 'saveorder' task, which fails to enforce authentication or capability checks. An unauthenticated remote attacker can submit a malicious payload via a crafted request to the booking engine. This payload is stored in the database and executed in the context of any user (including administrators) who views the compromised booking record in the management interface. The vulnerability is addressed in versions following 1.8.13.

Affected products

e4jvikwp VikBooking Hotel Booking Engine & PMS up to, and including, 1.8.13

Timeline

2026-07-24: disclosed
2026-07-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.