7.5
High
CVE-2026-15918 VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of…
Description
VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VikAppointments Services Booking Calendar 1.2 | earliest → 1.2.19 | No fix stated |
Other CVEs of VikAppointments Services Booking Calendar
The 4 CVEs of VikAppointments Services Booking Calendar →
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to…
9.1
Critical
CVE-2026-84768
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions
9.3
Critical
CVE-2025-22719
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…
7.1
High