The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to stored Cross‑Site Scripting (CWE‑79) via the ‘special_requests’ parameter because the input is stored in the database without proper sanitization or output escaping. This flaw allows an unauthenticated attacker to embed arbitrary JavaScript that will be served to any visitor who accesses a page containing the stored payload.

All installations of the VikBooking plugin for WordPress running version 1.8.8 or older are affected. The flaw exists in the plugin’s admin interface and booking order pages where the upgrade to 1.8.9 or later fixes the vulnerability. Because the vulnerability resides in the plugin rather than the WordPress core, other plugins or the core itself are not directly impacted, though any site user who views a page containing the injected page will have that script executed within the site’s domain.

The CVSS score of 7.2 indicates a medium‑high severity, while the EPSS score of <1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not catalogued in the CISA KEV database. Critical to note is that no authentication is required; an attacker can submit malicious content via the booking form or order creation page and have it stored for later use. When a visitor accesses a page that renders the “special_requests” field, the malicious script executes with the privileges of the site’s domain.