{"id":"CVE-2026-125789","kind":"vulnerability","aliases":["CVE-2026-125789"],"related":[],"title":"VikBooking: stored XSS lets attackers inject scripts into booking pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.20.","summary":"VikBooking Hotel Booking Engine & PMS, a WordPress plugin for hotel bookings, has a stored cross-site scripting flaw in versions up to 1.8.20. An attacker can store script code that runs in the browser of anyone who views the affected page, such as a site administrator.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VikBooking Hotel Booking Engine & PMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hotel-booking","runtime","vikbooking","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed VikBooking plugin version in the WordPress admin plugins list, or in the plugin's main file header.","fix":"- Move to a VikBooking version later than `1.8.20`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:28+00:00","updated_at":"2026-11-15T14:37:28+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-15T14:37:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a VikBooking version later than `1.8.20`; the exact fixed version is unknown from the sources.","reach":"internet","title":"VikBooking: stored XSS lets attackers inject scripts into booking pages","impact":"medium","summary":"VikBooking Hotel Booking Engine & PMS, a WordPress plugin for hotel bookings, has a stored cross-site scripting flaw in versions up to 1.8.20. An attacker can store script code that runs in the browser of anyone who views the affected page, such as a site administrator.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","vikbooking","hotel-booking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers, stealing admin sessions","analyst_note":"Find the vendor's fixed version and the exact vulnerable input and required role at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-125789 or the VikWP advisory.","how_to_check":"- Check the installed VikBooking plugin version in the WordPress admin plugins list, or in the plugin's main file header.\n- unknown","plain_action":"","product_name":"VikBooking Hotel Booking Engine & PMS","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running VikBooking Hotel Booking Engine & PMS at version 1.8.20 or earlier are affected. The sources do not say which input fields or roles can store the payload, so whether an unauthenticated visitor can exploit it is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000773,"input_tokens":4574,"output_tokens":632,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125789':13A,16A '-2026':12A,15A '1.8.20':51B,109C 'administr':74B 'affect':68B,100C 'allow':96C 'anyon':64B 'attack':5A,53B 'book':9A,24B,30B,38B,92C,103C 'booking':19A 'browser':62B 'code':57B 'cross':43B,84C 'cross-sit':42B,83C 'cve':11A,14A 'e4jvikwp':89C 'engin':31B,93C,104C 'engine':20A 'flaw':46B 'generat':82C 'hotel':18A,23B,29B,37B,91C,102C 'hotel-book':22B 'improp':75C 'inject':6A 'input':78C 'issu':99C 'let':4A 'n/a':107C 'neutral':76C 'page':10A,69B,81C 'plugin':35B 'pms':21A,32B,94C,105C 'run':59B 'runtim':25B 'script':7A,45B,56B,86C 'site':44B,73B,85C 'store':2A,41B,55B,97C 'version':48B 'view':66B 'vikbook':1A,26B,28B,90C,95C,101C 'vikbooking':17A 'vulner':87C 'web':80C 'wordpress':27B,34B 'xss':3A 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running VikBooking Hotel Booking Engine & PMS at version 1.8.20 or earlier are affected. The sources do not say which input fields or roles can store the payload, so whether an unauthenticated visitor can exploit it is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["hotelbookingenginepms","vikbookinghotelbookingenginepms"],"ptokens":["booking","engine","hotel","pms","vikbooking"],"labels":["high","hotelbooking","runtime","vendor","vikbooking","wordpress"],"campaign_type":null,"search_a":"'-125789':13A,16A '-2026':12A,15A 'attack':5A 'book':9A 'booking':19A 'cve':11A,14A 'engine':20A 'hotel':18A 'inject':6A 'let':4A 'page':10A 'pms':21A 'script':7A 'store':2A 'vikbook':1A 'vikbooking':17A 'xss':3A","search_b":"'1.8.20':51B 'administr':74B 'affect':68B 'anyon':64B 'attack':53B 'book':24B,30B,38B 'browser':62B 'code':57B 'cross':43B 'cross-sit':42B 'engin':31B 'flaw':46B 'hotel':23B,29B,37B 'hotel-book':22B 'page':69B 'plugin':35B 'pms':32B 'run':59B 'runtim':25B 'script':45B,56B 'site':44B,73B 'store':41B,55B 'version':48B 'view':66B 'vikbook':26B,28B 'wordpress':27B,34B","search_c":"'1.8.20':109C 'affect':100C 'allow':96C 'book':92C,103C 'cross':84C 'cross-sit':83C 'e4jvikwp':89C 'engin':93C,104C 'generat':82C 'hotel':91C,102C 'improp':75C 'input':78C 'issu':99C 'n/a':107C 'neutral':76C 'page':81C 'pms':94C,105C 'script':86C 'site':85C 'store':97C 'vikbook':90C,95C,101C 'vulner':87C 'web':80C 'xss.this':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125789","severity":null,"published_at":"2026-11-15T14:17:25+00:00","modified_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}