Stored Cross-Site Scripting in VikBooking Hotel Booking Engine & PMS Plugin for WordPress

CVE-2026-93429

What is CVE-2026-93429?

The VikBooking Hotel Booking Engine & PMS plugin for WordPress allows for stored cross-site scripting due to insufficient input sanitization and output escaping, specifically through the 'guests[][][documents]' parameter. This vulnerability affects all versions up to and including 1.8.17, enabling unauthenticated attackers to inject malicious scripts. Exploitation of this vulnerability necessitates that the attacker first acquires a valid booking session identifier, which can be obtained through a standard booking procedure. Once executed, the injected scripts will run on the pages accessed by users, potentially compromising user data and site security.

References