CyberRota Analysis
AI-GeneratedThe VikBooking Hotel Booking Engine & PMS WordPress plugin prior to version 1.8.15 is vulnerable due to inadequate restrictions on file types that unauthenticated users can attach in live chat, as well as a lack of content sanitization. This flaw allows malicious files to be stored and executed in the context of an administrator, potentially leading to unauthorized access or execution of harmful code. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.
Original NVD Description
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.