Technical impact
The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to inject malicious JavaScript code that is stored in the VikBooking database and served to all visitors. Successful exploitation can lead to session hijacking, defacement of booking pages, or theft of sensitive user information. The flaw is a classic stored XSS, giving the attacker a persistent foothold and the ability to affect confidentiality, integrity, and availability of the affected WordPress site.
Affected Systems
The affected product is the VikBooking Hotel Booking Engine & PMS WordPress plugin from e4jvikwp. Versions from the first release through 1.8.20 contain the flaw, and the vulnerability is fixed in version 1.8.21 and later.
Risk and Exploitability
The CVSS score of 7.1 indicates a medium‑to‑high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the plugin’s booking or configuration interfaces that accept user input; an attacker would need legitimate or compromised credentials to upload the malicious payload, which is then rendered on all pages that display booking information.
