VikBooking EUVD-2026-42214

Exploitation requires that the target site runs VikBooking 1.8.8 or earlier and that the attacker can reach the public booking workflow to submit a 'special_requests' value - the exact field named in the advisory. The payload is dormant until a user (in practice a hotel operator) opens the affected booking in the admin order-management pages (booking_details/editorder/orders views), so the primary limiting factor is that a back-end user must view the malicious order for the script to fire; injection itself needs no authentication (PR:N). No non-default configuration is required beyond having the plugin installed and accepting bookings.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) reflects unauthenticated, low-complexity, network-reachable injection with a scope change into the admin context, but only Low confidentiality/integrity impact and no availability impact - consistent with stored XSS rather than direct code execution. EPSS and SSVC data were not provided in the input, so exploitation probability cannot be quantified here. KEV=NO and no POC is referenced, so this is a High-CVSS issue without evidence of active exploitation; realistically it is a moderate priority: easy to inject but the payload only fires when a privileged operator opens the malicious booking, and the immediate technical impact is session/DOM-level rather than server compromise. Note a signal tension: NVD scores UI:N, yet the sink being an admin order-view page implies a victim must navigate to that page - verify whether truly no interaction is required.

An unauthenticated attacker submits a hotel booking through the public VikBooking form and places a JavaScript payload (e.g., an image tag with an onerror handler) in the 'special_requests' field. When a hotel staff member later opens that reservation in the WordPress admin order view, the script executes in their authenticated session, enabling actions such as cookie/session theft or admin-panel actions on their behalf. No public exploit code is referenced, but the low attack complexity makes weaponization straightforward.