---
id: "CVE-2026-125790"
page: "https://infrastack.ai/live/CVE-2026-125790"
kind: "vulnerability"
aliases: ["CVE-2026-125790"]
title: "VikBooking hotel booking plugin: stored XSS through versions 1.8.20"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "VikBooking Hotel Booking Engine & PMS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["hotel-booking", "other", "vikbooking", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-15T14:17:25+00:00"
first_seen_at: "2026-11-15T14:36:15+00:00"
updated_at: "2026-11-15T14:37:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125790", "first_seen_at": "2026-11-15T14:36:15+00:00"}]
exploit_sources: []
---

# VikBooking hotel booking plugin: stored XSS through versions 1.8.20

Link for people: https://infrastack.ai/live/CVE-2026-125790 (this .md is for agents)

VikBooking Hotel Booking Engine & PMS, a WordPress booking plugin, has a stored cross-site scripting flaw in versions up to 1.8.20. An attacker who can store malicious input in the booking system can run scripts in the browsers of other users who view that page, such as staff or guests.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VikBooking Hotel Booking Engine & PMS affected range not listed fixed no fixed version listed

## How to check

- Check the installed VikBooking plugin version in the WordPress admin plugin list or the `vikbooking` plugin header.

## Fix

- VikBooking Hotel Booking Engine & PMS: unknown; the sources name the affected range only through 1.8.20 and do not state a fixed version.

## Timeline

- 2026-11-15T14:36:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125790

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.20.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_