{"affected":[{"affectedData":[{"product":"VikBooking Hotel Booking Engine & PMS","vendor":"Unknown","versions":[{"lessThan":"1.5.8","status":"affected","version":"1.5.8","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:vikwp:hotel_booking_engine_\\&_pms:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"1A8EA3FF-E035-4AB8-9273-D20F1AAC403C","versionEndExcluding":"1.5.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack"},{"lang":"es","value":"El plugin VikBooking Hotel Booking Engine & PMS de WordPress versiones anteriores a 1.5.8, no presenta una comprobación de tipo CSRF cuando es añadida una campaña de seguimiento, y no escapa de los campos de la campaña cuando los muestra en los atributos. Como resultado, los atacantes podrían hacer que un administrador conectado añadiera una campaña de seguimiento con cargas útiles de tipo XSS en ellos por medio de un ataque de tipo CSRF"}],"id":"CVE-2022-1407","lastModified":"2026-06-17T04:22:23.800","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":4.3,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-05-16T15:15:09.463","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/19a9e266-daf6-4cc5-a300-2b5436b6d07d"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/19a9e266-daf6-4cc5-a300-2b5436b6d07d"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"contact@wpscan.com","type":"Secondary"}]}