The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site…

CVE-2026-12754 is a reflected cross-site scripting flaw in the VikBooking Hotel Booking Engine & PMS WordPress plugin. The layoutstyle GET parameter is echoed into the rendered page without proper output encoding, so an attacker who can convince a logged-in WordPress user to click a crafted URL gets arbitrary JavaScript executing in that user's browser under the site's origin. The bug affects VikBooking versions up to and including the last release before the vendor's July 2026 fix; older 1.x builds are also in scope because the vulnerable parameter has existed across the plugin's shortcode/booking-form dispatcher for multiple major versions.

The vendor's 6.1 MEDIUM rating is honest. Reflected XSS with UI:R and PR:N and a scope change is the textbook 6.1, and there's nothing here that argues for a bump — this is not stored XSS, it is not unauthenticated RCE, and it does not chain to plugin-wide takeover on its own. The realistic worst case is admin session hijack via a spear-phish, which is a real risk on a hotel front-desk laptop but a well-understood one.

Why this verdict

• User interaction required (UI:R): the chain does not start until a logged-in privileged user clicks a crafted link — no drive-by, no worming, no server-side compromise.
• HttpOnly session cookies: WordPress sets HttpOnly on auth cookies by default, so the classic cookie-steal outcome is blocked; the attacker is limited to in-browser session riding.
• Niche footprint: VikBooking is a specialized hospitality plugin with a small share of WP installs, further shrunk by CDN/WAF layers common on booking sites.
• Role multiplier — line-of-business web app: VikBooking is a booking front end, not a hypervisor, IdP, backup admin, or kernel-mode agent. Blast radius on a compromised admin session is defacement, malicious plugin install, or booking-data theft on that single site — high nuisance, not fleet-scale. No high-value-role floor is triggered.
• Not on KEV, no in-the-wild reports: reflected XSS in small-footprint WP plugins historically stays under EPSS 1% and rarely enters mass-exploitation.

Why not higher?

HIGH would require either stored XSS (persistence without a click), unauthenticated privilege escalation, or a role multiplier where the affected component is fleet-scale. None apply — this is a reflection in a query parameter on a booking plugin, gated by UI:R, with WordPress's default HttpOnly cookie policy blunting the most severe outcome.

Why not lower?

LOW / IGNORE understates the risk on a hotel front-desk workstation where staff routinely click links in booking notifications and reservation platforms — the phishing lure is contextually credible, admin sessions are often kept alive all day, and a successful hit yields malicious plugin install and booking-PII exposure on a regulated data set.

1. Deploy a strict Content-Security-Policy with script-src 'self' — A CSP without unsafe-inline neuters reflected XSS payloads at the browser layer. Add via a WordPress security plugin or web-server header. Deploy within the 365-day noisgate remediation window — but since MEDIUM has no mitigation SLA, prioritize this only if you cannot patch quickly.
2. Push the vendor patch to all VikBooking installs — Update to the July 2026 fixed release from e4j / VikWP. This is the real fix; every other control is stopgap. Complete within the noisgate remediation SLA of 365 days for MEDIUM — but for a plugin update this small, do it in the next maintenance window (days, not months).
3. Enforce a WAF rule blocking XSS payloads on the booking endpoint — Wordfence, Sucuri, and Cloudflare Managed Rules already flag <script>, onerror=, javascript:, and event-handler payloads in query strings. Confirm the rule is on in blocking (not log-only) mode for the VikBooking URLs.
4. Require 2FA for all WordPress admin/editor accounts — Even if a session is hijacked in-browser, forcing MFA re-prompts on privileged actions (plugin install, user creation, theme edit) via Wordfence Login Security or WP 2FA limits blast radius of a successful XSS click.
5. URL-rewrite/inspection at the mail gateway for hotel staff — Proofpoint URL Defense, Mimecast, or Microsoft Safe Links intercept the phishing click and detonate the link in a sandbox before the victim's browser reaches the vulnerable endpoint.

Run this on an auditor workstation with network reach to the target site. Invoke as ./check-vikbooking.sh https://hotelsite.example.com — no elevated privileges needed. It fetches the plugin readme.txt (public), parses Stable tag, and compares to the known-fixed version constant you set at the top of the script.

#!/usr/bin/env bash
# check-vikbooking.sh — CVE-2026-12754 detector
# Usage: ./check-vikbooking.sh https://target.example.com
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 https://target.example.com" >&2
  exit 2
 fi

# Set this to the first fixed release from the vendor advisory.
FIXED_VERSION="1.99.99"  # <-- update to real fixed version from e4j advisory

README_URL="${TARGET%/}/wp-content/plugins/vikbooking/readme.txt"
BODY=$(curl -fsSL --max-time 15 -A "noisgate-check/1.0" "$README_URL" 2>/dev/null)
RC=$?

if [[ $RC -ne 0 || -z "$BODY" ]]; then
  echo "UNKNOWN: could not fetch $README_URL (plugin absent, blocked, or hidden)"
  exit 3
fi

INSTALLED=$(printf '%s\n' "$BODY" | grep -iE '^Stable tag:' | head -n1 | awk -F: '{print $2}' | tr -d ' \r')

if [[ -z "$INSTALLED" ]]; then
  echo "UNKNOWN: readme.txt found but no Stable tag parsed"
  exit 3
fi

# Semver-ish compare using sort -V
LOWEST=$(printf '%s\n%s\n' "$INSTALLED" "$FIXED_VERSION" | sort -V | head -n1)
if [[ "$INSTALLED" == "$FIXED_VERSION" ]]; then
  echo "PATCHED: VikBooking $INSTALLED matches fixed version"
  exit 0
elif [[ "$LOWEST" == "$INSTALLED" ]]; then
  echo "VULNERABLE: VikBooking $INSTALLED < $FIXED_VERSION"
  exit 1
else
  echo "PATCHED: VikBooking $INSTALLED >= $FIXED_VERSION"
  exit 0
fi

Sources

1. NVD entry for CVE-2026-12754
2. Wordfence Intelligence — VikBooking advisories
3. Patchstack database — VikBooking
4. e4j / VikWP VikBooking plugin homepage
5. WordPress.org plugin page — VikBooking
6. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
7. OWASP Reflected XSS reference
8. CISA KEV catalog