What is the CVSS score of CVE-2026-12754?

CVE-2026-12754 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

VikBooking WordPress Plugin CVE-2026-12754

EUVD-2026-40939 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 Wordfence

GHSA-qvwp-h68m-3pjc

WordPress XSS Vikbooking Hotel Booking Engine Pms Wordpress Plugin E4Jvikwp

6.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-accessible reflected XSS with scope change; no auth required but victim click mandatory; shortcode condition does not raise AC beyond Low for a site actively using VikBooking.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 09:50 vuln.today

CVE Published

Jul 01, 2026 - 08:30 cve.org

MEDIUM 6.1

DescriptionCVE.org

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to render the [vikbooking view="roomslist"] shortcode, as the vulnerable layoutstyle parameter is only processed in that view context.

AnalysisAI

Reflected Cross-Site Scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.12) allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by tricking them into clicking a crafted URL. The vulnerable layoutstyle parameter is insufficiently sanitized before being rendered in the roomslist view template, enabling session hijacking, credential theft, or malicious redirects against authenticated site users such as hotel administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, and a patched version (1.8.13) is available per plugin Trac references.

Technical ContextAI

VikBooking is a WordPress plugin (CPE: cpe:2.3:a:e4jvikwp:vikbooking_hotel_booking_engine_&_pms:*:*:*:*:*:*:*:*) providing hotel booking and property management functionality. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS). The layoutstyle GET parameter is accepted by the roomslist view controller and reflected without adequate sanitization into the HTML output at lines 26 and 46 of site/views/roomslist/tmpl/default.php. The input filter logic in libraries/adapter/input/filter.php#L385 fails to strip or encode script-bearing payloads before they reach the template. Because the scope changes (S:C in the CVSS vector), the injected script executes in the victim's browser security context rather than the server, enabling cross-origin cookie access and DOM manipulation.

RemediationAI

Update VikBooking to version 1.8.13 or later, which contains the corrected output escaping in site/views/roomslist/tmpl/default.php per the upstream Trac repository (https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.13/site/views/roomslist/tmpl/default.php#L46). If an immediate upgrade is not feasible, a targeted workaround is to remove or temporarily disable any page or post containing the [vikbooking view="roomslist"] shortcode, which eliminates the attack surface entirely since the vulnerable parameter is only processed in that view context - note this will disable the rooms listing functionality for site visitors. Implementing a Web Application Firewall rule (e.g., Wordfence's built-in ruleset) to block requests with script patterns in the layoutstyle parameter is a secondary compensating control but should not substitute for patching. Full advisory and plugin update details are available via the Wordfence threat intel page linked above.