CVE-2026-12754: VikBooking WordPress Plugin Reflected XSS Vulnerability

Technical summary

CVE-2026-12754 is a reflected XSS flaw (CWE-79) in the VikBooking plugin for WordPress affecting versions through 1.8.12. The vulnerability stems from insufficient input sanitization and output escaping of the 'layoutstyle' parameter. The parameter is processed only when the [vikbooking view="roomslist"] shortcode is rendered on a page. The attack vector is network-based with low attack complexity; no authentication is required. Exploitation requires user interaction (UI:R) and results in limited confidentiality and integrity impact confined to the affected user's session (scope changed, affecting resources beyond the vulnerable component).

Business impact

For hotel websites and booking platforms using VikBooking, this vulnerability creates a targeted attack surface. Attackers could deceive hotel guests or staff into clicking malicious links that steal login credentials, hijack sessions, or redirect users to phishing pages. The impact is localized to individual user sessions rather than the server itself, but reputation damage is significant if customers are compromised. Hotels relying on this plugin should prioritize awareness and patching to prevent customer-facing security incidents.

Affected systems

WordPress installations using the VikBooking Hotel Booking Engine & PMS plugin in any version up to and including 1.8.12 are affected. The vulnerability only manifests on pages that include the [vikbooking view="roomslist"] shortcode. Sites using VikBooking without this specific shortcode, or that have already updated past 1.8.12, are not at risk from this particular flaw.

Exploitability

Exploitability is moderate. The attack is trivial to construct—crafting a malicious URL requires only inserting JavaScript into the layoutstyle parameter—but successful exploitation depends on social engineering. An attacker must trick a user into clicking a specially crafted link. There is no authentication requirement and no special configuration needed on the target site beyond the presence of the vulnerable shortcode. The CVSS score of 6.1 (MEDIUM) reflects the low technical barrier offset by the user interaction requirement.

Remediation

Update the VikBooking plugin to a version newer than 1.8.12. Check the plugin's official repository or vendor advisory for the patched version number. After updating, verify that all pages using the [vikbooking view="roomslist"] shortcode are served from the updated codebase. If an update is not immediately available, consider disabling or removing the plugin until a patch is released.

Patch guidance

Verify the latest patched version against the official VikBooking plugin documentation or WordPress.org plugin repository. Apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > VikBooking > Update if available) or manually if your environment requires it. Test the booking functionality on pages with the [vikbooking view="roomslist"] shortcode after patching to ensure no regression. If your environment does not use this specific shortcode, the vulnerability is not directly exploitable, but patching is still recommended as a best practice.

Detection guidance

Monitor web server and application logs for suspicious patterns in the 'layoutstyle' parameter on pages serving the [vikbooking view="roomslist"] shortcode. Look for URL-encoded or plain-text JavaScript code (e.g., 'script', 'onerror', 'onclick'). Web application firewalls (WAF) can block requests containing script tags or event handlers in this parameter. Endpoint detection and response (EDR) tools should monitor for unauthorized credential access or session tokens being exfiltrated from user browsers on your hotel booking pages.

Why prioritize this

This vulnerability warrants timely but not emergency attention. While the CVSS score is MEDIUM (6.1) and the flaw is not in CISA's KEV catalog, the combination of ease of exploitation and potential for customer-facing compromise makes it a priority for any hotel or booking site. The requirement for user interaction and the localized scope (reflected XSS, not stored) reduce urgency compared to high-severity server-side flaws, but the reputational risk to hospitality businesses is significant.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects a network-accessible, unauthenticated attack with low complexity, but requiring user interaction. Confidentiality and integrity impacts are rated as low because the attacker gains access only to the victim's session, not the server or other users' data directly. The scope change (S:C) indicates that the attack can affect resources beyond the vulnerable component (the user's browser and session). The absence of availability impact (no denial-of-service capability) and the requirement for user clicking a link both moderate the final score.

Frequently asked questions