Cross-site Scripting Vulnerability in VikBooking Hotel Booking Engine by e4jvikwp
CVE-2026-95591

7.1HIGH

Key Information:

Vendor

WordPress
Status
Vikbooking Hotel Booking Engine & Pms
Vendor
CVE Published:
9 October 2026

What is CVE-2026-95591?

The VikBooking Hotel Booking Engine & PMS, developed by e4jvikwp, is susceptible to a Cross-site Scripting (XSS) vulnerability due to improper input handling during web page generation. This flaw allows attackers to inject malicious scripts that could be executed in the user's browser, resulting in potential data theft or the manipulation of user sessions. The vulnerability affects multiple versions of the VikBooking system, specifically from n/a up to 1.8.14. It is crucial for users of the affected versions to apply security updates promptly to mitigate these risks.

Affected Version(s)

VikBooking Hotel Booking Engine & PMS 0 <= 1.8.14

References

https://patchstack.com/database/wordpress/plugin/vikbooki...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

neurotx | Patchstack Bug Bounty Program
.