Technical impact
The vulnerability is an improper neutralization of input during web page generation, allowing stored cross‑site scripting. Malicious JavaScript can be permanently stored in the VikBooking plugin’s database and rendered in future pages. Successful exploitation would run scripts in the context of users viewing affected pages, potentially stealing session cookies, credentials, or other sensitive data on the client side.
Affected Systems
The compromised product is the WordPress VikBooking Hotel Booking Engine & PMS plugin from e4jvikwp. Versions from the initial release through 1.8.20 are affected. The fix is included in version 1.8.21 and later.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity issue. EPSS data is not available, so the exact probability of exploitation cannot be quantified, but the vulnerability is not listed in CISA's KEV catalog, meaning there are no confirmed public exploits reported as of now. The likely attack vector is through web-based input fields where an attacker submits malicious payloads that the plugin stores and later serves to unsuspecting users. If exploited, the attacker could execute arbitrary client‑side code to steal credentials or hijack sessions.
