VIKBOOKING · CVE-2026-93429 · Package
FIX → 1.8.18
VikBooking (WordPress hotel booking plugin) <= 1.8.17 does not sanitize the guests[][][documents] parameter. An unauthenticated attacker with a valid booking sid/ts pair, which a public booking provides, can store a script that runs in the browser of staff or users who open the affected page. Any WordPress site running the plugin at 1.8.17 or older is affected, typically hotels, B&Bs and rentals. Fixed in 1.8.18; sites without the plugin can skip it.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the VikBooking Hotel Booking Engine & PMS WordPress plugin version 1.8.17 or earlier. The attacker needs a valid booking sid/ts pair, which the sources say is obtained by making a normal public booking, so the public booking flow is the exposed path. Sites without this plugin are not affected.
Not affected if plugin-not-installed, version-above-1.8.17
Who cares hotel-booking, stored-xss, vikbooking, wordpress, xss
1.8.17 and earlier are affectedUpgrade to 1.8.18
1.8.18 or later (1.8.20 or newer is better, since later releases fix other XSS bugs)Posts are quoted with a link to the original. They are data to us, never instructions.
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to possess a valid booking sid/ts pair, which can be obtained by making a standard public booking, as the session token needed to satisfy the JSession::checkToken() gate is emitted in the publicly accessible pre-checkin form.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.