We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

VikBooking Hotel Booking Engine & PMS Plugin Vulnerability (CVE-2026-15401)

Nick Paliughi
On this page

Security Alert Summary

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability via the vbfX parameter in versions up to and including 1.8.13. Insufficient input sanitization and output escaping, combined with a public-facing saveorder task that enforces no authentication or capability checks by default, allows unauthenticated attackers to submit and store malicious scripts that execute when a user views an injected page.

CVE Details

  • CVE ID: CVE-2026-15401
  • Affected component: VikBooking Hotel Booking Engine & PMS plugin for WordPress
  • Affected versions: All versions up to and including 1.8.13
  • Published: July 24, 2026 at 10:16:31 AM
  • Last modified: July 24, 2026 at 10:16:31 AM
  • CVSS v3.1: Base Score 7.2, Severity HIGH
  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction: Network attack vector, Privileges Required: NONE, User Interaction: NONE, Scope: CHANGED
  • Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
  • Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)

Technical Details

The vulnerability is a stored cross-site scripting issue involving the vbfX custom-field parameter. The plugin stores the vbfX value via the public-facing saveorder task. According to the provided information, this task does not enforce capability or authentication checks by default, and the plugin performs insufficient input sanitization and output escaping for the stored value.

Because the unsafe value is persisted and later rendered in pages, an attacker can submit a payload that will execute in the browser of any user who views the affected page. The exposure requires only that the attacker can submit data to the public saveorder endpoint; no authentication is required.

How This Could Impact Your Website

In a realistic scenario, an unauthenticated attacker could submit a malicious vbfX value via the public saveorder task. When a site owner, an internal staff member (such as a bookings manager), or an external contractor views the affected order or booking page, the injected script could execute in their browser. Practical consequences include unauthorized exposure of data displayed on the page and the ability to modify page content rendered to users.

Specific risks for a multi-user WordPress site include exposure of internal user email addresses or other data visible to staff, and an increased risk of targeted phishing or social engineering campaigns leveraging information harvested via the injected script. The vulnerability impacts confidentiality and integrity per the CVSS data; it does not indicate direct disruption of site availability.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributor-level accounts and other roles that can submit or edit content.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins to reduce attack surface.
  • Monitor site activity and logs for unusual behavior, including unexpected order submissions or changes to booking entries.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Open User Map – Interactive Leaflet Maps Plugin Vulnerability (CVE-2026-15755)
Next Post
WPForms Pro Plugin Vulnerability (CVE-2026-10818)