{"id":"CVE-2026-125790","kind":"vulnerability","aliases":["CVE-2026-125790"],"related":[],"title":"VikBooking hotel booking plugin: stored XSS through versions 1.8.20","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.20.","summary":"VikBooking Hotel Booking Engine & PMS, a WordPress booking plugin, has a stored cross-site scripting flaw in versions up to 1.8.20. An attacker who can store malicious input in the booking system can run scripts in the browsers of other users who view that page, such as staff or guests.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VikBooking Hotel Booking Engine & PMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hotel-booking","other","vikbooking","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed VikBooking plugin version in the WordPress admin plugin list or the `vikbooking` plugin header.","fix":"- VikBooking Hotel Booking Engine & PMS: unknown; the sources name the affected range only through 1.8.20 and do not state a fixed version.","status":"open","published_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:27+00:00","updated_at":"2026-11-15T14:37:27+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-15T14:37:27Z","model":"claude-haiku-5-5","output":{"fix":"- VikBooking Hotel Booking Engine & PMS: unknown; the sources name the affected range only through 1.8.20 and do not state a fixed version.","reach":"internet","title":"VikBooking hotel booking plugin: stored XSS through versions 1.8.20","impact":"medium","summary":"VikBooking Hotel Booking Engine & PMS, a WordPress booking plugin, has a stored cross-site scripting flaw in versions up to 1.8.20. An attacker who can store malicious input in the booking system can run scripts in the browsers of other users who view that page, such as staff or guests.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","vikbooking","hotel-booking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in other users' browsers, exposing their sessions or data.","analyst_note":"Find the vendor advisory or a fixed version for VikBooking after 1.8.20 and confirm which inputs are stored-XSS vectors and whether login is required.","how_to_check":"- Check the installed VikBooking plugin version in the WordPress admin plugin list or the `vikbooking` plugin header.\n- unknown for anything beyond the version check; the sources do not say which input fields or pages are affected.","plain_action":"","product_name":"VikBooking Hotel Booking Engine & PMS","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the VikBooking Hotel Booking Engine & PMS plugin at version 1.8.20 or earlier are affected. The sources do not say which input fields are exploitable or whether authentication is needed, so the exposure of any given site is unknown.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00079,"input_tokens":4574,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125790':12A,15A '-2026':11A,14A '1.8.20':9A,48B,112C 'affect':103C 'allow':99C 'attack':50B 'book':3A,23B,29B,34B,58B,95C,106C 'booking':18A 'browser':65B 'cross':40B,87C 'cross-sit':39B,86C 'cve':10A,13A 'e4jvikwp':92C 'engin':30B,96C,107C 'engine':19A 'flaw':43B 'generat':85C 'guest':77B 'hotel':2A,17A,22B,28B,94C,105C 'hotel-book':21B 'improp':78C 'input':55B,81C 'issu':102C 'malici':54B 'n/a':110C 'neutral':79C 'page':72B,84C 'plugin':4A,35B 'pms':20A,31B,97C,108C 'run':61B 'script':42B,62B,89C 'site':41B,88C 'staff':75B 'store':5A,38B,53B,100C 'system':59B 'user':68B 'version':8A,45B 'view':70B 'vikbook':1A,25B,27B,93C,98C,104C 'vikbooking':16A 'vulner':90C 'web':83C 'wordpress':26B,33B 'xss':6A 'xss.this':101C","nicknames":[],"mitigations":[],"who_affected":"Sites running the VikBooking Hotel Booking Engine & PMS plugin at version 1.8.20 or earlier are affected. The sources do not say which input fields are exploitable or whether authentication is needed, so the exposure of any given site is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["hotelbookingenginepms","vikbookinghotelbookingenginepms"],"ptokens":["booking","engine","hotel","pms","vikbooking"],"labels":["high","hotelbooking","other","vendor","vikbooking","wordpress"],"campaign_type":null,"search_a":"'-125790':12A,15A '-2026':11A,14A '1.8.20':9A 'book':3A 'booking':18A 'cve':10A,13A 'engine':19A 'hotel':2A,17A 'plugin':4A 'pms':20A 'store':5A 'version':8A 'vikbook':1A 'vikbooking':16A 'xss':6A","search_b":"'1.8.20':48B 'attack':50B 'book':23B,29B,34B,58B 'browser':65B 'cross':40B 'cross-sit':39B 'engin':30B 'flaw':43B 'guest':77B 'hotel':22B,28B 'hotel-book':21B 'input':55B 'malici':54B 'page':72B 'plugin':35B 'pms':31B 'run':61B 'script':42B,62B 'site':41B 'staff':75B 'store':38B,53B 'system':59B 'user':68B 'version':45B 'view':70B 'vikbook':25B,27B 'wordpress':26B,33B","search_c":"'1.8.20':112C 'affect':103C 'allow':99C 'book':95C,106C 'cross':87C 'cross-sit':86C 'e4jvikwp':92C 'engin':96C,107C 'generat':85C 'hotel':94C,105C 'improp':78C 'input':81C 'issu':102C 'n/a':110C 'neutral':79C 'page':84C 'pms':97C,108C 'script':89C 'site':88C 'store':100C 'vikbook':93C,98C,104C 'vulner':90C 'web':83C 'xss.this':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125790","severity":null,"published_at":"2026-11-15T14:17:25+00:00","modified_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}