Cross-site Scripting Vulnerability in VikBooking Hotel Booking Engine by e4jvikwp
CVE-2026-42762

7.1HIGH

Key Information:

Vendor

WordPress
Status
Vikbooking Hotel Booking Engine & Pms
Vendor
CVE Published:
27 May 2026

What is CVE-2026-42762?

The VikBooking Hotel Booking Engine & PMS, developed by e4jvikwp, contains a vulnerability that allows attackers to exploit improper neutralization of input during web page generation. This flaw can lead to DOM-Based Cross-site Scripting (XSS) vulnerabilities, where untrusted data is executed in the user's browser. Attackers could potentially manipulate web content to execute malicious scripts, leading to data theft, unauthorised actions, or other harmful effects. The affected versions include those up to and including 1.8.9.

Affected Version(s)

VikBooking Hotel Booking Engine & PMS 0 <= 1.8.9

References

https://patchstack.com/database/Wordpress/Plugin/vikbooki...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

anhcd05 | Patchstack Bug Bounty Program
.