7.5
Élevée
CVE-2026-15918 VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of…
Description
VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| VikAppointments Services Booking Calendar 1.2 | premières → 1.2.19 | Pas de correctif indiqué |
Autres CVE de VikAppointments Services Booking Calendar
Les 4 CVE de VikAppointments Services Booking Calendar →
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to…
9.1
Critique
CVE-2026-84768
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions
9.3
Critique
CVE-2025-22719
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…
7.1
Élevée