CVE-2026-15346 in VikBooking Hotel Booking Engine & PMS Plugin
Summary
by MITRE • 07/24/2026
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The VikBooking Hotel Booking Engine & PMS plugin for WordPress represents a significant security vulnerability through its susceptibility to reflected cross-site scripting attacks via the category_id parameter. This flaw exists in all versions up to and including 1.8.13, making it a widespread concern across numerous installations. The vulnerability stems from inadequate input sanitization practices combined with insufficient output escaping mechanisms that fail to properly neutralize malicious script content before rendering it within web pages.
The technical implementation of this vulnerability allows attackers to inject arbitrary web scripts into the plugin's response handling mechanism through the category_id parameter. When user-supplied input containing malicious code is processed without proper validation, the system reflects this content back to users who subsequently view the affected page. The attack vector becomes operational when an attacker can successfully manipulate a victim into clicking on a maliciously crafted link that contains the harmful script payload. This reflected nature of the vulnerability means that the malicious code originates from an external source rather than being permanently stored within the application.
The operational impact of this vulnerability is particularly concerning as it affects unauthenticated attackers who can exploit the weakness without requiring any prior access credentials or privileged positions within the system. The vulnerability's effectiveness is limited to browsers that support access keys due to the injection occurring within a hidden element, which reduces its attack surface but does not eliminate the risk entirely. This restriction means that while the attack may be more difficult to execute successfully, it remains a legitimate threat vector that could potentially compromise user sessions or redirect visitors to malicious sites.
Security professionals should note that this vulnerability aligns with common weakness enumerations such as CWE-79, which specifically addresses cross-site scripting flaws in web applications. The flaw also demonstrates characteristics consistent with attack patterns documented in the ATT&CK framework under the execution category, where adversaries leverage web-based attacks to execute malicious code within victim environments. The presence of this vulnerability in a widely-used WordPress plugin increases the potential attack surface significantly, particularly for hotel booking systems that may handle sensitive customer information and transaction data.
Organizations utilizing this plugin should immediately implement mitigations including input validation and output escaping measures, while also considering immediate version upgrades to patched releases where available. The recommended approach involves sanitizing all user-supplied parameters through proper encoding and validation techniques, ensuring that any potentially harmful characters or script tags are neutralized before processing. Additionally, implementing content security policies and regular security audits can help prevent similar vulnerabilities from emerging in the future while maintaining robust protection against reflected XSS attacks across all web application components.