CVE-2022-1407
VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
El plugin VikBooking Hotel Booking Engine & PMS de WordPress versiones anteriores a 1.5.8, no presenta una comprobación de tipo CSRF cuando es añadida una campaña de seguimiento, y no escapa de los campos de la campaña cuando los muestra en los atributos. Como resultado, los atacantes podrían hacer que un administrador conectado añadiera una campaña de seguimiento con cargas útiles de tipo XSS en ellos por medio de un ataque de tipo CSRF
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-04-20 CVE Reserved
- 2022-04-21 CVE Published
- 2023-12-07 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/19a9e266-daf6-4cc5-a300-2b5436b6d07d | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vikwp Search vendor "Vikwp" | Hotel Booking Engine \& Pms Search vendor "Vikwp" for product "Hotel Booking Engine \& Pms" | < 1.5.8 Search vendor "Vikwp" for product "Hotel Booking Engine \& Pms" and version " < 1.5.8" | wordpress |
Affected
| ||||||