title: VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF
description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: VikBooking Hotel Booking Engine & PMS
vendor: Unknown
versions:
lessThan: 1.5.8, status: affected, version: 1.5.8, versionType: custom
}