---
id: "CVE-2026-93429"
page: "https://infrastack.ai/live/CVE-2026-93429"
kind: "vulnerability"
aliases: ["CVE-2026-93429"]
title: "VikBooking WordPress plugin: stored XSS via guest documents parameter"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "vikbooking", "fixed": ["1.8.18"], "affected": "<= 1.8.17", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["hotel-booking", "package", "stored-xss", "vikbooking", "wordpress", "xss"]
not_affected_if: ["plugin-not-installed", "version-above-1.8.17"]
published_at: "2026-11-07T12:17:46+00:00"
first_seen_at: "2026-11-07T12:47:09+00:00"
updated_at: "2026-11-07T12:50:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93429", "first_seen_at": "2026-11-07T12:47:09+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter", "first_seen_at": "2026-11-07T12:50:18+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter", "https://patchstack.com/database/wordpress/plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-17-unauthenticated-stored-cross-site-scripting-vulnerability", "https://wordpress.org/plugins/vikbooking/"]}]
exploit_sources: []
---

# VikBooking WordPress plugin: stored XSS via guest documents parameter

Link for people: https://infrastack.ai/live/CVE-2026-93429 (this .md is for agents)

VikBooking (WordPress hotel booking plugin) <= 1.8.17 does not sanitize the guests[][][documents] parameter. An unauthenticated attacker with a valid booking sid/ts pair, which a public booking provides, can store a script that runs in the browser of staff or users who open the affected page. Any WordPress site running the plugin at 1.8.17 or older is affected, typically hotels, B&Bs and rentals. Fixed in 1.8.18; sites without the plugin can skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:vikbooking affected <= 1.8.17 fixed 1.8.18

## How to check

In wp-admin > Plugins, check the VikBooking Hotel Booking Engine & PMS version; 1.8.17 and earlier are affected. Or run: wp plugin get vikbooking --field=version. Also check if the pre-checkin form is publicly reachable.

## Fix

Update VikBooking to 1.8.18 or later (1.8.20 or newer is better, since later releases fix other XSS bugs). Fix version per Wordfence and Patchstack.

## Timeline

- 2026-11-07T12:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93429
- 2026-11-07T12:50:18+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter — Fix 1.8.18 per Wordfence and Patchstack (third-party; vendor changelog not readable, so nothing marked verified). Plugin page shows later releases (1.8.19, 1.8.20 fixed other XSS), so advise latest. Attack needs a valid booking sid/ts pair, obtainable via a public booking. No exploitation or PoC seen. who_is_affected flag not accepted by the CLI, so it is folded into the summary.

## Documents

- [advisory] Wordfence: VikBooking <= 1.8.17 stored XSS via guests[][][documents] https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter
- [advisory] Patchstack: VikBooking <= 1.8.17 XSS https://patchstack.com/database/wordpress/plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-17-unauthenticated-stored-cross-site-scripting-vulnerability
- [describes] VikBooking plugin page (WordPress.org) https://wordpress.org/plugins/vikbooking/

## From the sources

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to possess a valid booking sid/ts pair, which can be obtained by making a standard public booking, as the session token needed to satisfy the JSession::checkToken() gate is emitted in the publicly accessible pre-checkin form.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_