Security Alert Summary
The VikBooking Hotel Booking Engine & PMS WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in the handling of the layoutstyle parameter. An unauthenticated attacker can craft a URL or link that triggers script injection when a targeted user loads a page rendering the [vikbooking view="roomslist"] shortcode. Exploitation requires the victim to interact with the crafted link or page.
CVE Details
- CVE ID: CVE-2026-12754
- Affected component: VikBooking Hotel Booking Engine & PMS plugin for WordPress
- Affected versions: All versions up to and including 1.8.12
- Published: July 1, 2026 10:16:26 AM
- Last modified: July 1, 2026 1:56:17 PM
- CVSS v3.1: Base Score 6.1, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction:
- Authentication: Not required (unauthenticated attacker)
- Privileges required: None
- User interaction: Required (victim must interact with crafted content)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
The vulnerability is a reflected cross-site scripting issue caused by insufficient input sanitization and missing output escaping for the layoutstyle parameter. The plugin processes this parameter only when the roomslist view is rendered via the [vikbooking view="roomslist"] shortcode, so pages that do not render that view are not affected.
The issue appears in the request handling and template rendering path for the rooms list; references point to the plugin files where input filtering and template output are handled, for example libraries/adapter/input/filter.php and site/views/roomslist/tmpl/default.php. When the layoutstyle parameter is included in a request and the roomslist view renders it without proper sanitization and escaping, an attacker-supplied payload can be reflected into the page and executed in a victim’s browser if they load the crafted link.
Impact is limited to what can be accomplished from a reflected XSS context: execution of JavaScript in the victim’s browser within the site’s origin. This can be used to run actions available to the victim’s browser session, steal volatile data accessible in the page context, or perform targeted social-engineering actions against users who follow a malicious link. The behavior requires a user to interact with the attacker-controlled content and does not, by itself, indicate direct server-side code execution or complete site compromise.
How This Could Impact Your Website
Consider a small hotel website managed by an owner, with internal staff responsible for listings and an external contractor who occasionally edits content. If a pages that renders the roomslist view is reachable and a staff member or external contributor clicks a crafted link, an attacker could execute scripts in that user’s browser. Practical consequences include the exposure of session-limited data or information visible on the page, which could increase the risk of targeted phishing or social-engineering attacks against staff or contractors.
For example, a marketing contractor who manages room listings could be tricked into opening a link that runs a script to capture their active session data or to perform actions on their behalf in the browser. While this vulnerability does not by itself indicate server-side takeover, it raises the chance of credential theft or targeted scams using harvested account details or visible contact information.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege accounts that can edit or view affected pages.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site activity and access logs for unusual behavior or unexpected requests that include script-like payloads.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/libraries/adapter/input/filter.php#L385
- https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/views/roomslist/tmpl/default.php#L26
- https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.12/site/views/roomslist/tmpl/default.php#L46
- https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/views/roomslist/tmpl/default.php#L46
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6d126213-e342-4271-aca0-5cc47214ae8b?source=cve
