The vulnerability lies in improper neutralization of user input during web page generation, leading to a DOM-based cross-site scripting flaw. An attacker can inject malicious JavaScript into pages rendered by the VikBooking plugin, which may steal session cookies, deface content, or redirect users to phishing sites. The flaw could be exploited by attackers who can influence user inputs or URLs that the plugin processes.

The issue affects the WordPress plugin VikBooking Hotel Booking Engine & PMS from its earliest releases through version 1.8.9. Administrators of sites running these plugin versions are at risk, regardless of their WordPress core version.

The CVSS score is 7.1, indicating a high severity with potential impact on confidentiality and integrity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack execution requires a client-side interaction, such that a user is tricked into visiting a crafted link or input that the plugin does not properly sanitize. While no public exploit scripts are documented, the DOM-based nature means that typical phishing or drive-by-attack vectors could be used.