The vulnerability exists in the VikBooking Hotel Booking Engine & PMS plugin for WordPress. An unauthenticated attacker can submit malicious code through the 'guests[][][documents]' parameter because the plugin fails to sanitize input or escape output. The malicious code is stored in the database and rendered when another user views the affected page, allowing the attacker to run arbitrary scripts in the victim’s browser. This can lead to session hijacking, defacement, or phishing attacks on any logged‑in user who accesses the compromised page.

All installations of the VikBooking plugin for WordPress that are at version 1.8.17 or earlier are affected. Sites running any older release, including 1.8.15 and 1.8.16, use the vulnerable code path highlighted in the plugin’s booking check‑in views and controller files. The plugin is typically used on hotel booking sites and property management systems that rely on WordPress for front‑end booking functionality.

The CVSS base score of 7.2 indicates a high severity vulnerability that can be exploited without authentication. The attack requires only a publicly visible booking process to obtain a valid session token and the sid/ts pair, which can be generated by creating a standard public booking. Because EPSS data is not available and the flaw is not listed in the CISA KEV catalog, current exploitation data is limited, but the ability to store arbitrary scripts and the high likelihood of widespread use of the plugin make the risk significant. The vulnerability is reachable through standard web requests to the booking check‑in endpoint, and does not require privileged access or special network conditions.