CVE-2026-42683

Vulnerability

The VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions from n/a through 1.8.8) contains a DOM-based Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This affects the plugin's booking engine and property management system components where client-side scripts handle dynamic content without proper sanitization, allowing attackers to inject arbitrary HTML or JavaScript code that executes in the context of a victim's browser session.

Exploitation

Exploitation requires a privileged user (such as an admin or editor) to interact with a crafted link or visit a specially prepared page that triggers the insecure DOM manipulation [1]. The attacker must first identify a vulnerable input point within the plugin's interface and craft a malicious URL or form that, when processed by the victim's browser, injects script code into the page's DOM. No authentication from the attacker is needed, but the targeted user must be logged in and perform an action like clicking a link or submitting a form.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's WordPress admin or frontend session [1]. This can lead to session hijacking, redirection to malicious sites, injection of advertisements, or defacement of the website. The attacker gains the ability to perform actions on behalf of the victim user, potentially modifying plugin settings, accessing sensitive booking data, or escalating privileges if the victim has administrative rights.

Mitigation

The vulnerability is fixed in version 1.8.9 of the VikBooking plugin [1]. Users should update immediately to this version or later. For those unable to update, Patchstack offers a mitigation rule that blocks attacks until the update is applied [1]. No workarounds other than updating or applying a virtual patch are mentioned. The vulnerability is listed as moderately dangerous and expected to be exploited in mass campaigns, so prompt remediation is advised [1].