VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Reflected Cross-Site Scripting via Pagination Links
- ID
- WPSEC-2026-0345
- Plugin
- VikBooking Hotel Booking Engine & PMS (vikbooking)
- Affected
- all versions before 1.8.16
- Remediation
- Update to 1.8.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- VikBooking Hotel Booking Engine & PMS on WPSec AttackSurface
- Fix released
- Published
Description
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via request query parameters in all versions up to, and including, 1.8.15. This is due to the plugin decoding the current request URL and writing it into pagination link href attributes without escaping on front-end pages that display paginated listings, such as the rooms list and packages list views. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0345/
- https://plugins.svn.wordpress.org/vikbooking/tags/1.8.16/
- https://wordpress.org/plugins/vikbooking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS