CVE-2026-42683: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability

Synopsis

A DOM-based cross-site scripting (XSS) vulnerability exists in the VikBooking Hotel Booking Engine and PMS WordPress plugin at version 1.8.8 and earlier. The flaw is reachable over the network without any authentication, but requires a victim to interact with a crafted link or page, derived from the CVSS vector (AV:N, PR:N, UI:R). Successful exploitation allows an attacker to run arbitrary JavaScript in the victim's browser, enabling session theft, page content manipulation, and limited availability disruption. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can deliver a malicious payload from any internet-accessible origin without needing local or adjacent access.

• AuthenticationNot required

  No account or credentials are needed to craft and deliver the malicious payload to a target.

• Victim interactionRequired

  A victim must take an action such as clicking a crafted link or visiting an attacker-controlled page that triggers the DOM-based XSS payload in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads the victim's active session cookies, enabling account hijacking if the cookies are not marked HttpOnly.
• Injects and executes arbitrary JavaScript in the victim's browser session, allowing manipulation of booking forms or displayed reservation data.
• Modifies visible page content in the victim's browser, enabling phishing or credential-harvesting overlays targeting hotel guests or administrators.
• Degrades the victim's browser session by injecting scripts that consume resources or redirect the user away from the legitimate site.