{"id":"CVE-2026-93429","kind":"vulnerability","aliases":["CVE-2026-93429"],"related":[],"title":"VikBooking WordPress plugin: stored XSS via guest documents parameter","description":"The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to possess a valid booking sid/ts pair, which can be obtained by making a standard public booking, as the session token needed to satisfy the JSession::checkToken() gate is emitted in the publicly accessible pre-checkin form.","summary":"VikBooking (WordPress hotel booking plugin) <= 1.8.17 does not sanitize the guests[][][documents] parameter. An unauthenticated attacker with a valid booking sid/ts pair, which a public booking provides, can store a script that runs in the browser of staff or users who open the affected page. Any WordPress site running the plugin at 1.8.17 or older is affected, typically hotels, B&Bs and rentals. Fixed in 1.8.18; sites without the plugin can skip it.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vikbooking","fixed":["1.8.18"],"affected":"<= 1.8.17","ecosystem":"wordpress"}],"ecosystems":[],"tags":["hotel-booking","package","stored-xss","vikbooking","wordpress","xss"],"not_affected_if":["plugin-not-installed","version-above-1.8.17"],"how_to_check":"In wp-admin > Plugins, check the VikBooking Hotel Booking Engine & PMS version; 1.8.17 and earlier are affected. Or run: wp plugin get vikbooking --field=version. Also check if the pre-checkin form is publicly reachable.","fix":"Update VikBooking to 1.8.18 or later (1.8.20 or newer is better, since later releases fix other XSS bugs). Fix version per Wordfence and Patchstack.","status":"open","published_at":"2026-11-07T12:17:46+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","triaged_at":"2026-11-07T12:48:44+00:00","updated_at":"2026-11-07T12:50:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T12:48:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VikBooking WordPress plugin: stored XSS via guest documents parameter","impact":"medium","summary":"The VikBooking Hotel Booking Engine & PMS plugin for WordPress does not sanitize the 'guests[][][documents]' parameter in versions up to and including 1.8.17. An unauthenticated attacker can store scripts that run in the browser of anyone who opens the affected page, such as hotel staff.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vikbooking","hotel-booking"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker scripts run in staff or guest browsers on booking pages","analyst_note":"Check the vendor or WordPress plugin page for a fixed version after 1.8.17; the NVD text does not name one.","how_to_check":"- Check the installed VikBooking plugin version in the WordPress admin Plugins page; the sources say versions up to and including `1.8.17` are affected.\n- Confirm whether the site runs the VikBooking Hotel Booking Engine & PMS plugin at all.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-1.8.17"],"who_is_affected":"Sites running the VikBooking Hotel Booking Engine & PMS WordPress plugin version 1.8.17 or earlier. The attacker needs a valid booking sid/ts pair, which the sources say is obtained by making a normal public booking, so the public booking flow is the exposed path. Sites without this plugin are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4364,"output_tokens":611,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the vendor or WordPress plugin page for a fixed version after 1.8.17; the NVD text does not name one.","search":"'-2026':11A,14A '-93429':12A,15A '1.8.17':32B,79B,127C '1.8.18':92B 'access':156C,197C 'affect':70B,83B 'arbitrari':145C 'attack':42B,142C,163C 'b':86B 'book':19B,30B,46B,52B,102C,168C,180C 'browser':62B 'bs':87B 'checkin':200C 'checktoken':190C 'cross':113C 'cross-sit':112C 'cve':10A,13A 'document':8A,38B,118C 'due':128C 'emit':193C 'engin':103C 'escap':135C 'execut':152C 'fix':90B 'form':201C 'gate':191C 'guest':7A,37B,117C 'hotel':18B,29B,85B,101C 'hotel-book':17B 'includ':126C 'inject':144C,158C 'input':131C 'insuffici':130C 'jsession':189C 'make':137C,176C 'need':185C 'obtain':174C 'older':81B 'open':68B 'output':134C 'packag':20B 'page':71B,149C,159C 'pair':48B,170C 'paramet':9A,39B,119C 'plugin':3A,31B,77B,96B,105C 'pms':104C 'possess':165C 'possibl':139C 'pre':199C 'pre-checkin':198C 'provid':53B 'public':51B,179C,196C 'rental':89B 'requir':161C 'run':59B,75B 'sanit':35B,132C 'satisfi':187C 'script':57B,115C,147C 'session':183C 'sid/ts':47B,169C 'site':74B,93B,114C 'skip':98B 'staff':64B 'standard':178C 'store':4A,22B,55B,111C 'stored-xss':21B 'token':184C 'typic':84B 'unauthent':41B,141C 'user':66B,155C 'valid':45B,167C 'version':122C 'via':6A,116C 'vikbook':1A,24B,27B,100C 'vikbooking':16A 'vulner':109C 'web':146C 'whenev':153C 'without':94B 'wordpress':2A,25B,28B,73B,107C 'xss':5A,23B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the VikBooking Hotel Booking Engine & PMS WordPress plugin version 1.8.17 or earlier. The attacker needs a valid booking sid/ts pair, which the sources say is obtained by making a normal public booking, so the public booking flow is the exposed path. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vikbooking"],"ptokens":["vikbooking"],"labels":["high","hotelbooking","package","storedxss","vikbooking","wordpress","xss"],"campaign_type":null,"search_a":"'-2026':11A,14A '-93429':12A,15A 'cve':10A,13A 'document':8A 'guest':7A 'paramet':9A 'plugin':3A 'store':4A 'via':6A 'vikbook':1A 'vikbooking':16A 'wordpress':2A 'xss':5A","search_b":"'1.8.17':32B,79B '1.8.18':92B 'affect':70B,83B 'attack':42B 'b':86B 'book':19B,30B,46B,52B 'browser':62B 'bs':87B 'document':38B 'fix':90B 'guest':37B 'hotel':18B,29B,85B 'hotel-book':17B 'older':81B 'open':68B 'packag':20B 'page':71B 'pair':48B 'paramet':39B 'plugin':31B,77B,96B 'provid':53B 'public':51B 'rental':89B 'run':59B,75B 'sanit':35B 'script':57B 'sid/ts':47B 'site':74B,93B 'skip':98B 'staff':64B 'store':22B,55B 'stored-xss':21B 'typic':84B 'unauthent':41B 'user':66B 'valid':45B 'vikbook':24B,27B 'without':94B 'wordpress':25B,28B,73B 'xss':23B,26B","search_c":"'1.8.17':127C 'access':156C,197C 'arbitrari':145C 'attack':142C,163C 'book':102C,168C,180C 'checkin':200C 'checktoken':190C 'cross':113C 'cross-sit':112C 'document':118C 'due':128C 'emit':193C 'engin':103C 'escap':135C 'execut':152C 'form':201C 'gate':191C 'guest':117C 'hotel':101C 'includ':126C 'inject':144C,158C 'input':131C 'insuffici':130C 'jsession':189C 'make':137C,176C 'need':185C 'obtain':174C 'output':134C 'page':149C,159C 'pair':170C 'paramet':119C 'plugin':105C 'pms':104C 'possess':165C 'possibl':139C 'pre':199C 'pre-checkin':198C 'public':179C,196C 'requir':161C 'sanit':132C 'satisfi':187C 'script':115C,147C 'session':183C 'sid/ts':169C 'site':114C 'standard':178C 'store':111C 'token':184C 'unauthent':141C 'user':155C 'valid':167C 'version':122C 'via':116C 'vikbook':100C 'vulner':109C 'web':146C 'whenev':153C 'wordpress':107C","first_public_at":"2026-11-07T12:17:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93429","severity":null,"published_at":"2026-11-07T12:17:46+00:00","modified_at":"2026-11-07T12:17:47+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","fetched_at":"2026-11-07T12:47:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93429:2109","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter","severity":null,"published_at":"2026-11-07T12:50:18+00:00","modified_at":"2026-11-07T12:50:18+00:00","first_seen_at":"2026-11-07T12:50:18+00:00","fetched_at":"2026-11-07T12:50:18+00:00","note":"Fix 1.8.18 per Wordfence and Patchstack (third-party; vendor changelog not readable, so nothing marked verified). Plugin page shows later releases (1.8.19, 1.8.20 fixed other XSS), so advise latest. Attack needs a valid booking sid/ts pair, obtainable via a public booking. No exploitation or PoC seen. who_is_affected flag not accepted by the CLI, so it is folded into the summary.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter","https://patchstack.com/database/wordpress/plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-17-unauthenticated-stored-cross-site-scripting-vulnerability","https://wordpress.org/plugins/vikbooking/"]}],"documents":[{"id":95551,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter","title":"Wordfence: VikBooking <= 1.8.17 stored XSS via guests[][][documents]","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95553,"url":"https://patchstack.com/database/wordpress/plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-17-unauthenticated-stored-cross-site-scripting-vulnerability","title":"Patchstack: VikBooking <= 1.8.17 XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95554,"url":"https://wordpress.org/plugins/vikbooking/","title":"VikBooking plugin page (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}