Vulnerabilities and security researches forvikappointments vikappointments

Oct 06, 2026

CVE, Research URL: CVE-2026-87115
Home page URL: Security reports for VikAppointments Services Booking Calendar
Application: VikAppointments Services Booking Calendar
Date: Oct 03, 2026
Research Description: The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
Affected versions: max 1.2.22.
Status: vulnerable

Sep 05, 2026

CVE, Research URL: CVE-2026-84768
Home page URL: Security reports for VikAppointments Services Booking Calendar
Application: VikAppointments Services Booking Calendar
Date: Sep 03, 2026
Research Description: Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
Affected versions: max 1.2.21.
Status: vulnerable

Aug 06, 2026

CVE, Research URL: CVE-2026-15918
Home page URL: Security reports for VikAppointments Services Booking Calendar
Application: VikAppointments Services Booking Calendar
Date: Aug 05, 2026
Research Description: VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required
Affected versions: max 1.2.20.
Status: vulnerable

Jan 19, 2025

CVE, Research URL: CVE-2025-22719
Home page URL: Security reports for VikAppointments Services Booking Calendar
Application: VikAppointments Services Booking Calendar
Date: Jan 21, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikappointments allows Stored XSS.This issue affects VikAppointments Services Booking Calendar: from n/a through <= 1.2.16.
Affected versions: max 1.2.17.
Status: vulnerable