The plugin contains a stored cross‑site scripting flaw that allows an unauthenticated attacker to embed arbitrary JavaScript within the booking form’s email field. Because the input is neither sanitized nor properly escaped, the malicious payload is written to the database and executed whenever a user views the affected page. This classic stored XSS (CWE‑79) can cause unwanted execution of JavaScript code on victim browsers. The issue spans all releases of the VikBooking Hotel Booking Engine & PMS plugin for WordPress up to and including version 1.8.8. Sites running any of these be addressed. The CVSS score of 7.2 indicates a high severity level. An EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Since the flaw can be triggered without authentication, an attacker can simply submit a booking form containing a crafted email value; the resulting script is stored and later executed for all users who view the affected page.

The vulnerability affects the VikBooking Hotel Booking Engine & PMS WordPress plugin, versions up to and including 1.8.8. Any site running an affected version is vulnerable to stored cross‑site scripting when a booking form’s email field contains malicious code.

The flaw is a stored cross‑site scripting vulnerability with a CVSS score of 7.2. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires no authentication; an attacker can simply submit a booking form containing a crafted email value. The malicious payload is then stored and executed for any user who visits the affected page.