# cve.now: E4jvikwp

The newest entries naming E4jvikwp as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-93429](https://cve.now/CVE-2026-93429.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests\[\]\[\]\[documents\]' Parameter (CVSS 7.2)
- [CVE-2026-116548](https://cve.now/CVE-2026-116548.md): VikRentCar Car Rental Management System \<= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter (CVSS 7.2)
- [CVE-2026-115840](https://cve.now/CVE-2026-115840.md): VikRentCar Car Rental Management System \<= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter (CVSS 7.2)
- [CVE-2026-116405](https://cve.now/CVE-2026-116405.md): WordPress VikRentCar plugin \<= 1.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-28160](https://cve.now/CVE-2026-28160.md): WordPress VikRentCar plugin \<= 1.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-116750](https://cve.now/CVE-2026-116750.md): VikRentCar Car Rental Management System \<= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute (CVSS 6.5)
- [CVE-2026-116749](https://cve.now/CVE-2026-116749.md): VikRentCar Car Rental Management System \<= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute (CVSS 6.4)
- [CVE-2026-111120](https://cve.now/CVE-2026-111120.md): VikRentCar Car Rental Management System \<= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext\_update\_tmpl' AJAX Task (CVSS 8.8)
- [CVE-2026-112835](https://cve.now/CVE-2026-112835.md): WordPress VikRentCar plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-112838](https://cve.now/CVE-2026-112838.md): WordPress VikRentCar plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-112836](https://cve.now/CVE-2026-112836.md): WordPress VikRentCar plugin \<= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- [CVE-2026-95684](https://cve.now/CVE-2026-95684.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments\[name\]' Parameter (CVSS 7.2)
- [CVE-2026-95591](https://cve.now/CVE-2026-95591.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-39790](https://cve.now/CVE-2026-39790.md): WordPress VikRentCar plugin \<= 1.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-87115](https://cve.now/CVE-2026-87115.md): VikAppointments Services Booking Calendar \<= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old\_vapcfN' Parameter (CVSS 9.1)
- [CVE-2026-84768](https://cve.now/CVE-2026-84768.md): WordPress VikAppointments Services Booking Calendar plugin \<= 1.2.20 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-15918](https://cve.now/CVE-2026-15918.md): VikAppointments – Services Booking Calendar \<= 1.2.19 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2026-16143](https://cve.now/CVE-2026-16143.md): VikRentItems Flexible Rental Management System \<= 1.2.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2026-15401](https://cve.now/CVE-2026-15401.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter (CVSS 7.2)
- [CVE-2026-15346](https://cve.now/CVE-2026-15346.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.13 - Reflected Cross-Site Scripting via 'category\_id' Parameter (CVSS 6.1)
- [CVE-2026-6820](https://cve.now/CVE-2026-6820.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field (CVSS 7.2)
- [CVE-2026-6818](https://cve.now/CVE-2026-6818.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special\_requests' Parameter (CVSS 7.2)
- [CVE-2026-57723](https://cve.now/CVE-2026-57723.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability (CVSS 7.4)
- [CVE-2026-12754](https://cve.now/CVE-2026-12754.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter (CVSS 6.1)
- [CVE-2026-52699](https://cve.now/CVE-2026-52699.md): WordPress VikRentCar plugin \<= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5)
- [CVE-2026-42683](https://cve.now/CVE-2026-42683.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-42762](https://cve.now/CVE-2026-42762.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-42737](https://cve.now/CVE-2026-42737.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.9 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2026-25025](https://cve.now/CVE-2026-25025.md): WordPress VikRestaurants plugin \<= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-49918](https://cve.now/CVE-2025-49918.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.2 - Sensitive Data Exposure vulnerability (CVSS 5.9)
- [CVE-2025-14049](https://cve.now/CVE-2025-14049.md): VikRentItems Flexible Rental Management System \<= 1.2.0 - Reflected Cross-Site Scripting via 'delto' Parameter (CVSS 6.1)
- [CVE-2025-13724](https://cve.now/CVE-2025-13724.md): VikRentCar Car Rental Management System \<= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter (CVSS 7.5)
- [CVE-2025-5803](https://cve.now/CVE-2025-5803.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-57962](https://cve.now/CVE-2025-57962.md): WordPress VikRestaurants Table Reservations and Take-Away plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-57968](https://cve.now/CVE-2025-57968.md): WordPress VikRestaurants Table Reservations and Take-Away plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-5322](https://cve.now/CVE-2025-5322.md): VikRentCar Car Rental Management System \<= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2)
- [CVE-2025-46251](https://cve.now/CVE-2025-46251.md): WordPress VikRestaurants Table Reservations and Take-Away plugin \<= 1.3.3 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2025-22670](https://cve.now/CVE-2025-22670.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.7.2 - CSRF to Settings Change vulnerability (CVSS 6.5)
- [CVE-2024-11640](https://cve.now/CVE-2024-11640.md): VikRentCar Car Rental Management System \<= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2024-11641](https://cve.now/CVE-2024-11641.md): VikBooking Hotel Booking Engine & PMS \<= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-22719](https://cve.now/CVE-2025-22719.md): WordPress VikAppointments Services Booking Calendar plugin \<= 1.2.16 - CSRF to Stored XSS vulnerability (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/e4jvikwp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.