What is the CVSS score of CVE-2026-6820?

CVE-2026-6820 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of VikBooking are affected by CVE-2026-6820?

VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) exposes hotels' booking systems and administrative staff to code injection attacks that do not require prior…

How to fix or mitigate CVE-2026-6820?

Within 24 hours: Disable VikBooking plugin on all WordPress installations running version 1.8.8 or earlier; audit server logs for malicious email parameter submissions. Within 7 days: Implement WAF rules to block JavaScript and event handlers in email fields; enforce multi-factor authentication on all administrative accounts. Within 30 days: Apply vendor-released patch immediately upon availability, or migrate to alternative booking platform if vendor patch is not provided within 60 days.

VikBooking CVE-2026-6820

EUVD-2026-42231 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 Wordfence

GHSA-v4gf-r4fj-p25m

WordPress XSS Vikbooking Hotel Booking Engine Pms Wordpress Plugin E4Jvikwp

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network-reachable stored injection (AV:N/AC:L/PR:N); scope change as payload executes in a separate victim browser context (S:C) with limited confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 13:18 vuln.today

CVE Published

Jul 08, 2026 - 12:33 cve.org

HIGH 7.2

DescriptionCVE.org

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.8) lets unauthenticated remote attackers persist arbitrary JavaScript via the 'email' parameter, which then executes in the browser of any user - including hotel staff and admins - who later views the affected page. Because the injection point is reachable without authentication and the payload is stored server-side, it enables session hijacking, admin action forgery, and content defacement against booking-management back offices. This issue is not in CISA KEV and no public exploit has been identified at time of analysis.

Technical ContextAI

VikBooking is a commercial hotel reservation, property-management, and booking-engine plugin for WordPress published by e4jVikWP (CPE cpe:2.3:a:e4jvikwp:vikbooking_hotel_booking_engine_&_pms). The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: user-supplied data in the 'email' field is neither sanitized on input nor escaped on output, so HTML/script metacharacters survive into rendered pages. The referenced fixes in the 1.8.9 source tree (site/controller.php line 307 and admin/controller.php line 11208) indicate the tainted value flows from a public/front-end submission path into both front-end and administrative rendering contexts, making it a stored (persistent) XSS rather than a reflected one.

RemediationAI

Vendor-released patch: upgrade to VikBooking 1.8.9 or later, which adds the missing input sanitization and output escaping on the 'email' parameter in both the front-end and admin controllers; this is the primary and complete fix. Until the update is applied, restrict or filter untrusted access to the booking-submission endpoint that accepts the 'email' field - for example, place a WAF/virtual-patch rule (Wordfence provides one via its threat-intel feed at https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b4586a-f87d-4a51-8f4e-932d7254518e) to block script/HTML metacharacters in that parameter, accepting the trade-off that overly strict rules may reject legitimately unusual email input. Administrators who suspect prior injection should audit stored booking records and rendered admin pages for embedded markup and purge any tainted entries, since patching does not retroactively clean already-stored payloads.