CVE-2026-15346: VikBooking WordPress Plugin XSS Vulnerability

CVE-2026-15346 Overview

CVE-2026-15346 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the VikBooking Hotel Booking Engine & PMS plugin for WordPress. The flaw affects all plugin versions up to and including 1.8.13. Attackers can inject arbitrary JavaScript through the category_id parameter due to insufficient input sanitization and output escaping. Exploitation requires user interaction, typically clicking a crafted link. The injection occurs inside a hidden HTML element, so execution is limited to browsers that support access keys. No authentication is required to craft the malicious request.

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser session, enabling session token theft, credential harvesting, or redirection to attacker-controlled resources.

Affected Products

VikBooking Hotel Booking Engine & PMS plugin for WordPress, versions up to and including 1.8.13
WordPress sites using the vulnerable search view template (site/views/search/tmpl/default.php)
WordPress installations relying on the plugin's input filter adapter (libraries/adapter/input/filter.php)

Discovery Timeline

2026-07-24 - CVE-2026-15346 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-15346

Vulnerability Analysis

The vulnerability resides in how VikBooking processes the category_id request parameter within the plugin's search view. The plugin passes user-supplied input into the rendered HTML output without applying sufficient sanitization or context-appropriate output escaping. Because the value is reflected directly into a hidden HTML element, attackers can break out of the intended attribute context and inject arbitrary markup or script content. The vulnerability is classified as a Reflected XSS with a scope change, meaning injected content executes in the security context of the WordPress site rather than the attacker's origin. Successful exploitation requires the victim to click a malicious link and use a browser that honors the accesskey attribute, which triggers execution of the injected payload inside the hidden element.

Root Cause

The root cause is missing output escaping in the search template files at lines 43, 385, and 409 of site/views/search/tmpl/default.php. The input filter defined in libraries/adapter/input/filter.php at line 233 does not neutralize script-relevant characters when the parameter is rendered inside HTML attributes. As a result, values from category_id reach the browser without HTML-entity encoding.

Attack Vector

An unauthenticated attacker crafts a URL containing a malicious category_id payload that breaks out of the hidden element's attribute context and introduces an accesskey handler with injected script. The attacker delivers the link through phishing, forums, or social media. When a victim opens the link in a compatible browser and triggers the access key, the payload executes in the site's origin. See the Wordfence Vulnerability Summary and the WordPress Plugin Search Template for the vulnerable rendering path.

Detection Methods for CVE-2026-15346

Indicators of Compromise

Requests to WordPress URLs containing a category_id parameter with HTML-encoded characters, angle brackets, quotes, or the accesskey attribute string
Access log entries with category_id values containing <script>, onerror=, onclick=, or javascript: substrings
Referrer headers pointing to external phishing infrastructure combined with search view requests

Detection Strategies

Inspect web server access logs for anomalous or oversized category_id query values on paths that invoke the VikBooking search view
Deploy a Web Application Firewall (WAF) rule that flags reflected script payloads and accesskey injection patterns in query strings
Correlate outbound browser requests to suspicious domains immediately following clicks on WordPress search URLs

Monitoring Recommendations

Enable verbose HTTP access logging on WordPress sites running VikBooking and ship logs to a centralized analytics platform
Monitor authenticated administrator sessions for anomalous activity that follows link clicks, such as unexpected plugin or user changes
Track WordPress plugin inventory and alert when VikBooking versions at or below 1.8.13 are detected

How to Mitigate CVE-2026-15346

Immediate Actions Required

Update the VikBooking Hotel Booking Engine & PMS plugin to a version above 1.8.13 as soon as an official fix is released by the vendor
Audit WordPress sites to identify installations of the plugin at or below 1.8.13 and prioritize remediation
Instruct administrators and staff to avoid clicking untrusted booking or search links until patched

Patch Information

At the time of publication, versions up to and including 1.8.13 are vulnerable. Refer to the WordPress Plugin Changeset for vendor code changes and the Wordfence Vulnerability Summary for tracking a fixed release.

Workarounds

Configure a WAF rule to strip or block requests where the category_id parameter contains HTML metacharacters such as <, >, ", ', or the string accesskey
Apply Content Security Policy (CSP) headers that restrict inline script execution to reduce impact of reflected payloads
Temporarily disable the VikBooking plugin on non-production sites until an upstream fix is available

bash

# Example WAF rule (ModSecurity) blocking XSS payloads in category_id
SecRule ARGS:category_id "@rx (?i)(<|%3c|accesskey|onerror|onclick|javascript:)" \
    "id:1015346,phase:2,deny,status:403,log,msg:'CVE-2026-15346 VikBooking category_id XSS attempt'"