VikBooking CVE-2026-95591

Exploitation requires an attacker to deliver a crafted link containing the reflected payload to a victim and have that victim load it in an authenticated browser context (UI:R in the vector), so it is gated by user interaction and social engineering rather than being autonomous. The advisory does not name a specific feature or non-default setting, implying the vulnerable parameter is reachable in a standard install of the VikBooking Hotel Booking Engine & PMS plugin (versions n/a through 1.8.14). The practical limiting factors are: the need to trick a user into clicking, the value of the targeted user's session (impact is highest against an administrator), and the requirement that the site run an affected plugin version.

This is a reflected cross-site scripting (CWE-79) flaw in the VikBooking Hotel Booking Engine & PMS WordPress plugin, scored 7.1 by the reporter (Patchstack) via CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vector indicates network attack, low complexity, no privileges, but mandatory user interaction (UI:R) - the elevated 7.1 (versus the usual 6.1 for reflected XSS) stems from the scope change (S:C) and the reporter's assignment of A:L, which is atypical for reflected XSS (availability impact is normally N). No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Realistically this is a moderate-priority issue rather than an urgent one: reflected XSS requires social-engineering a victim (typically an authenticated admin) into clicking a crafted link, which bounds its blast radius compared to a stored or unauthenticated-impact flaw. EPSS/KEV data being absent is not itself a red flag but means exploitation-probability signals cannot be weighed - prioritize patching, but it does not rise to emergency status absent further exploitation signals.

An attacker crafts a URL for a vulnerable VikBooking endpoint with a malicious script payload in a reflected parameter and lures a logged-in site administrator (or privileged user) into clicking it, e.g. via phishing email. When the page renders the unsanitized input, the script executes in the victim's browser session, potentially hijacking the session or performing actions as that user. No public exploit code was provided in the input.