What is the CVSS score of CVE-2026-6818?

CVE-2026-6818 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of VikBooking are affected by CVE-2026-6818?

VikBooking, a WordPress hotel booking plugin, contains a stored cross-site scripting vulnerability in versions through 1.8.8 that allows unauthenticated attackers to inject and persist malicious…

How to fix or mitigate CVE-2026-6818?

Within 24 hours: Inventory all WordPress installations running VikBooking versions ≤1.8.8; instruct hotel operations staff to report any suspicious characters or code-like text in booking special requests fields. Within 7 days: Update all VikBooking installations to version 1.8.9 or later; verify patch deployment across all WordPress sites. Within 30 days: Conduct WordPress plugin security baseline audit; implement automated plugin update notifications and establish mandatory patch deployment SLA for critical and high-severity vulnerabilities.

VikBooking CVE-2026-6818

EUVD-2026-42214 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 Wordfence

GHSA-4827-4gjr-3cr2

WordPress XSS Vikbooking Hotel Booking Engine Pms Wordpress Plugin E4Jvikwp

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (PR:N/AV:N/AC:L) but the stored payload only fires when an operator opens the admin order page (UI:R), executing across a security boundary (S:C) with limited C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:37 vuln.today

CVE Published

Jul 08, 2026 - 11:30 nvd

HIGH 7.2

DescriptionCVE.org

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated attackers persist arbitrary JavaScript via the 'special_requests' booking field, which then executes when a hotel operator or user views the injected order in the admin back-end. Reported by Wordfence with a CVSS 7.2 (scope-changed) rating; no public exploit identified at time of analysis and it is not listed in CISA KEV. The fix landed in version 1.8.9, whose patched source is referenced in the advisory.

Technical ContextAI

The affected component is the VikBooking plugin (CPE cpe:2.3:a:e4jvikwp:vikbooking_hotel_booking_engine_&_pms), a commercial hotel property-management and reservation engine built on WordPress/PHP. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the guest-supplied 'special_requests' value is stored without sufficient input sanitization and rendered without proper output escaping. The patched 1.8.9 source referenced in the advisory (admin/helpers/widgets/booking_details.php, admin/views/editorder/tmpl/default.php, and admin/views/orders/tmpl/default.php) shows the sink is in the administrative order-management views, meaning the payload is stored at booking time and reflected back into the operator-facing back-end pages.

RemediationAI

Vendor-released patch: update the VikBooking plugin to version 1.8.9 or later, which adds the missing sanitization/escaping on the 'special_requests' field (patched files viewable at https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.9/). Until you can upgrade, place the WordPress admin/booking-management endpoints behind a WAF rule that strips or blocks script tags and event-handler attributes in the booking 'special_requests' parameter, and restrict access to the wp-admin order views to trusted IPs - the trade-off is that strict WAF filtering can reject legitimate special requests containing angle brackets, and IP restriction complicates remote staff access. Review existing bookings for already-stored payloads before treating the issue as closed. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/13a96e78-c83c-4ff1-a751-3dbaeb683d9d?source=cve) for detection guidance.