CVE-2022-1408

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	VikBooking Hotel Booking Engine & PMS	>= 1.5.8, < 1.5.8

References

https://wpscan.com/vulnerability/48dccf4c-07e0-4877-867d-f8f43aeb5705Exploit, Third Party Advisory
https://wpscan.com/vulnerability/48dccf4c-07e0-4877-867d-f8f43aeb5705Exploit, Third Party Advisory

Timeline

Published: May 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14097.2The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users suc CVE-2022-14108.8OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to e CVE-2022-14116.1Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims CVE-2022-14127.5The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any u CVE-2022-14137.5Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and CVE-2022-14148.83scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to CVE-2022-14158.8A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authen CVE-2022-14165.4Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versio CVE-2022-14174.3Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9 CVE-2022-14186.1The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no CVE-2022-14197.8The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created i CVE-2022-14205.5Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.