PT-2026-45436 · WordPress · Vikbooking Hotel Booking Engine & Pms

Evan Nr · Published 2026-06-01 · Updated 2026-06-04 · CVE-2026-42683

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions e4jvikwp VikBooking Hotel Booking Engine & PMS versions prior to 1.8.9

Description Improper neutralization of input during web page generation allows DOM-Based Cross-Site Scripting (XSS), a flaw where the application contains client-side scripts that execute malicious code in the user's browser due to unsafe handling of data.

Recommendations Update to a version later than 1.8.8.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42683

Affected Products

Vikbooking Hotel Booking Engine & Pms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-42683 · Security Note
• https://patchstack.com/database/wordpress/plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/2061490796369518621 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2062324785418285251 · Twitter Post