CVE-2026-85127: VikBooking WordPress Plugin XSS Vulnerability

CVE-2026-85127 Overview

CVE-2026-85127 is a stored Cross-Site Scripting (XSS) vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15. The plugin fails to restrict file types that unauthenticated visitors can attach to its live chat feature. It also does not sanitize the contents of those attachments. An attacker can upload a file containing active content that executes in the browser context of any administrator who views the conversation. The flaw is categorized under CWE-79 and affects WordPress sites running the vulnerable plugin.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover, privilege escalation, and full WordPress site compromise.

Affected Products

VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15
WordPress installations exposing the plugin's live chat feature to unauthenticated visitors
Hotel and property management sites using VikBooking for guest communications

Discovery Timeline

2026-09-18 - CVE-2026-85127 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-85127

Vulnerability Analysis

The VikBooking plugin exposes a live chat channel that unauthenticated visitors can use to contact hotel staff. The chat interface accepts file attachments without validating the file type or scanning the content for executable payloads. When an administrator later opens the conversation in the WordPress backend, the attached file renders inside the administrator's authenticated session. This turns the chat feature into a delivery mechanism for stored XSS payloads.

An attacker uploads an HTML, SVG, or similar file containing JavaScript through the public chat endpoint. The payload persists in the plugin's message store. When any privileged user views the conversation, the browser executes the script under the WordPress admin origin. Attackers can hijack sessions, create new administrator accounts, exfiltrate data, or install malicious plugins.

Root Cause

The root cause is a combination of missing file-type restrictions and absent output sanitization on attachment contents. The plugin trusts unauthenticated input and renders it in a privileged context without applying WordPress escaping functions such as esc_html() or content-type enforcement on served attachments.

Attack Vector

Exploitation requires network access to the WordPress site and administrator interaction to view the malicious message. No authentication or elevated privileges are required from the attacker. The attack chain is: (1) attacker opens a live chat session as an anonymous visitor, (2) attacker uploads an attachment containing active content, (3) administrator opens the chat conversation, (4) payload executes in the administrator's browser.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-85127

Indicators of Compromise

Unexpected file attachments in VikBooking live chat conversations, especially .html, .svg, .js, .htm, or .xml extensions
New WordPress administrator accounts created without a corresponding audit trail
Unexplained plugin or theme installations following administrator access to the chat inbox
Outbound network requests from administrator browsers to unfamiliar domains after opening chat messages

Detection Strategies

Audit the plugin's chat attachment storage directory for files with executable MIME types or scripting extensions
Review WordPress wp_users and wp_usermeta tables for administrator role assignments that do not match legitimate provisioning records
Inspect web server access logs for unauthenticated POST requests to VikBooking chat endpoints that include file upload parameters
Search for <script>, onerror=, or onload= strings within stored chat message payloads in the database

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/uploads/ directory and plugin storage paths
Forward WordPress audit logs and web server logs to a centralized SIEM for correlation with administrator session activity
Alert on creation of new administrator accounts and modifications to privileged user roles
Monitor administrator browser sessions for anomalous requests to wp-admin/user-new.php and plugin installation endpoints

How to Mitigate CVE-2026-85127

Immediate Actions Required

Update the VikBooking Hotel Booking Engine & PMS plugin to version 1.8.15 or later on all WordPress installations
Review all live chat conversations for suspicious attachments uploaded prior to the update and delete any that contain active content
Rotate credentials and session tokens for all WordPress administrator accounts that accessed the chat interface
Audit administrator accounts and remove any unauthorized users created since the plugin was deployed

Patch Information

The vendor addressed the vulnerability in VikBooking version 1.8.15. The fix restricts allowed file types on chat attachments and sanitizes rendered content. Refer to the WPScan Vulnerability Report for advisory details and upgrade instructions.

Workarounds

Disable the VikBooking live chat feature until the plugin can be upgraded to 1.8.15 or later
Restrict access to the WordPress admin chat interface using IP allow-listing at the web server or WAF layer
Deploy a web application firewall rule to block file uploads to VikBooking chat endpoints with executable extensions such as .html, .svg, .js, and .xml
Configure the web server to serve plugin-uploaded attachments with a Content-Disposition: attachment header to prevent inline rendering

bash

# Nginx configuration example: force download of chat attachments
location ~* /wp-content/uploads/vikbooking/chat/ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    types { } default_type application/octet-stream;
}