CVE-2026-12754: VikBooking WordPress Plugin XSS Vulnerability

CVE-2026-12754 Overview

CVE-2026-12754 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the VikBooking Hotel Booking Engine & PMS plugin for WordPress. The flaw affects all plugin versions up to and including 1.8.12. The vulnerability exists in the layoutstyle parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation requires the targeted page to render the [vikbooking view="roomslist"] shortcode, since the vulnerable parameter is only processed in that view context.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure when a user is tricked into clicking a malicious link.

Affected Products

VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to and including 1.8.12
WordPress sites rendering the [vikbooking view="roomslist"] shortcode
Fixed in VikBooking version 1.8.13

Discovery Timeline

2026-07-01 - CVE-2026-12754 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12754

Vulnerability Analysis

The vulnerability resides in how the VikBooking plugin processes the layoutstyle HTTP parameter within the room list view. The plugin's input filter located at libraries/adapter/input/filter.php fails to adequately sanitize the parameter value before passing it into template rendering logic. The roomslist view template at site/views/roomslist/tmpl/default.php then reflects the parameter directly into HTML output without proper contextual escaping. This allows an attacker to embed JavaScript payloads inside the parameter value, which the server echoes back into the response. When a victim visits the crafted URL, the injected script executes in the security context of the vulnerable WordPress site.

Root Cause

The root cause is a combination of missing input sanitization in the plugin's adapter filter layer and missing output escaping in the room list template. The layoutstyle parameter is treated as trusted display data rather than untrusted user input. Because the value is written directly into the rendered HTML, an attacker can break out of the intended attribute or element context and inject arbitrary markup and script content.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to a WordPress page that renders the [vikbooking view="roomslist"] shortcode and appends a malicious layoutstyle query parameter containing a JavaScript payload. The attacker then delivers the link through phishing, forum posts, social media, or malicious advertising. When the victim clicks the link, the injected script executes in the victim's browser under the origin of the vulnerable site. This scope change to another security domain increases the potential impact of successful exploitation. See the Wordfence Vulnerability Report and the VikBooking Code Review for source-level references.

Detection Methods for CVE-2026-12754

Indicators of Compromise

HTTP requests containing the layoutstyle parameter with encoded or literal <script>, javascript:, onerror=, or onload= payloads
Access logs showing GET requests to pages hosting the roomslist shortcode with unusually long or URL-encoded layoutstyle values
Outbound requests from user browsers to unknown domains shortly after visiting a page containing the vulnerable shortcode
Referrer headers indicating phishing or third-party domains delivering crafted links to VikBooking-enabled pages

Detection Strategies

Inspect web server access logs for query strings containing layoutstyle= followed by HTML-encoded angle brackets or event handler attributes
Deploy Web Application Firewall (WAF) rules that flag reflected script payloads targeting WordPress plugin parameters
Correlate suspicious inbound URLs with subsequent DOM-based indicators such as unexpected redirects or credential form submissions

Monitoring Recommendations

Enable request logging for all pages using the [vikbooking view="roomslist"] shortcode
Monitor for spikes in 200 OK responses to parameterized requests on VikBooking-enabled URLs
Alert on client-side Content Security Policy (CSP) violations that indicate blocked inline script execution

How to Mitigate CVE-2026-12754

Immediate Actions Required

Update the VikBooking Hotel Booking Engine & PMS plugin to version 1.8.13 or later on all WordPress installations
Audit all pages containing the [vikbooking view="roomslist"] shortcode and review recent access logs for exploitation attempts
Rotate administrative session cookies and force re-authentication if suspicious requests are identified

Patch Information

The vendor addressed the flaw in VikBooking version 1.8.13. The fix is visible in the updated template at site/views/roomslist/tmpl/default.php, which now applies proper output escaping to the layoutstyle value. Refer to the patched template and the Wordfence Vulnerability Report for remediation details.

Workarounds

Temporarily remove the [vikbooking view="roomslist"] shortcode from public-facing pages until the patch is applied
Deploy a WAF rule that blocks requests containing script-like content in the layoutstyle parameter
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Example WAF rule (ModSecurity) to block XSS payloads in layoutstyle parameter
SecRule ARGS:layoutstyle "@rx (?i)(<script|javascript:|onerror=|onload=|<svg|<iframe)" \
  "id:1026127540,phase:2,deny,status:403,log,msg:'CVE-2026-12754 VikBooking layoutstyle XSS attempt'"