VikBooking WordPress Plugin CVE-2026-12754

Exploitation requires three specific, concurrent conditions. First, the target WordPress site must have the VikBooking plugin installed at version 1.8.12 or earlier. Second, at least one publicly accessible page on the site must include and render the [vikbooking view="roomslist"] shortcode - the layoutstyle parameter is only processed in this view context, so pages or sites not exposing this shortcode are not vulnerable. Third, a victim user (ideally an authenticated administrator for maximum impact) must be socially engineered into clicking a crafted link containing the malicious layoutstyle value. The CVSS vector (PR:N) confirms no authentication is required of the attacker, but UI:R confirms victim interaction is mandatory. Exploitation is limited by: the shortcode deployment requirement (not all VikBooking installations may have a public-facing roomslist page), the need to trick a specific user, and the absence of any persistence mechanism in the XSS payload itself.

The CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is appropriate: network-reachable, low complexity, no authentication required, but dependent on user interaction and producing only limited confidentiality and integrity impact. No EPSS data was supplied in the input, and neither a CISA KEV listing nor public proof-of-concept code has been identified, which meaningfully reduces near-term exploitation urgency compared to a KEV-listed XSS. The practical exploitation barrier is meaningful: an attacker must identify a VikBooking-powered site with the roomslist shortcode exposed on a publicly accessible page and then successfully socially engineer a victim (typically an admin) into clicking a crafted link. For hotel operators with WordPress admin accounts, the realistic impact is admin session hijacking enabling full site takeover. The risk is real but not acute absent active exploitation signals - prioritize patching during next maintenance window rather than emergency response.

An attacker targeting a hotel website identifies a publicly accessible WordPress page rendering the [vikbooking view="roomslist"] shortcode. The attacker crafts a URL appending a malicious layoutstyle parameter containing a JavaScript payload (e.g., a cookie-stealing script) and delivers it to a logged-in hotel administrator via a phishing email or social media message. When the admin clicks the link, the unescaped payload executes in their browser, transmitting the WordPress session cookie to an attacker-controlled server and granting full administrative access to the site. No public proof-of-concept has been identified at time of analysis.