Skip to main content
mySites.guru
Free Audit
NewAdd every Joomla and WordPress site on a WHM or cPanel server in one goSee how it works

Vik Booking security vulnerabilities

mySites.guru tracks 2 vulnerabilities in Vik Booking (com_vikbooking). Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs Vik Booking in any of these ranges:

  • before 1.18.21
  • before 1.18.19
Latest safe version
1.18.21 or later. No rule we check matches that release or any newer one.
What to do
Update Vik Booking to 1.18.21 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every Vik Booking vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
No CVE idbefore 1.18.211.18.21Medium2026-11-11
No CVE idbefore 1.18.191.18.19Medium2026-10-26

What we check for

Medium2026-11-11

Vik Booking (com_vikbooking) below 1.18.21 - Stored XSS via SVG Check-in Signature, Missing CSRF and Access Checks on Back-end Tasks

Vik Booking before 1.18.21 let the front-end check-in signature task (storesignature) accept a base64 SVG image and write it unsanitised to administrator/components/com_vikbooking/resources/idscans/, a web-accessible folder, so anyone holding a confirmed booking's sid/ts pair (obtainable by making an ordinary public booking) could store an SVG containing script that runs on the site's own origin when the file is opened, including by an administrator reviewing check-in documents. The same release also adds missing CSRF token checks and core.vbo.management/core.vbo.bookings permission checks to several back-end tasks (invoice management and download, check-in document creation, booking creation from the calendar, rate creation), strips HTML from front-end booking form custom-field values, sanitises inquiry field keys, and adds an option to keep guest media files above the web root. Fixed in 1.18.21 (11 Nov 2026). E4J's changelog only says "Various CSRF and capability checks added" and "SVG and images sanitising techniques"; the details here come from mySites.guru diffing the same-day WordPress release (1.8.21) of the same codebase. No CVE; severity is mySites.guru's own assessment. Update to 1.18.21 or later, then enable the new setting to keep guest media above the web root.

Affected versions: < 1.18.21

Full advisory: our disclosure post

Medium2026-10-26

Vik Booking (com_vikbooking) below 1.18.19 - Stored XSS via Custom Fields, CSRF and Missing Access Check on the Front-end Information Request

Vik Booking before 1.18.19 printed custom-field names and popup-link URLs unescaped on the front-end booking confirmation and room details pages (stored XSS, set by an administrator), and the front-end reqinfo (information request) task had no CSRF token check and still answered when contact requests were switched off for the room. Fixed in 1.18.19 (26 Oct 2026), the third Vik Booking security release in a week after 1.18.17 (CSRF protections) and 1.18.18 (security review fixes). E4J publish no Joomla changelog; this is taken from the same-day WordPress release (1.8.19) of the same codebase. No CVE; severity is mySites.guru's own assessment.

Affected versions: < 1.18.19

Full advisory: our disclosure post

Timeline

  1. 26 October 2026Check added for a flaw with no CVE id (before 1.18.19)
  2. 11 November 2026Check added for a flaw with no CVE id (before 1.18.21)

References

Vik Booking vulnerability questions

Which versions of Vik Booking are vulnerable?
mySites.guru tracks 2 vulnerabilities in Vik Booking (com_vikbooking). A site is affected if its installed version is in any of these ranges: before 1.18.21; before 1.18.19.
What is the latest safe version of Vik Booking?
1.18.21. Every vulnerability tracked here is fixed by 1.18.21, and no rule we check matches that release or any later one.
How do I check which version of Vik Booking my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_vikbooking. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running Vik Booking on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 11 November 2026.