CVE-2026-95684: VikBooking WordPress Plugin XSS Vulnerability

CVE-2026-95684 Overview

CVE-2026-95684 is a stored Cross-Site Scripting (XSS) vulnerability in the VikBooking Hotel Booking Engine & PMS plugin for WordPress. The flaw affects all versions up to and including 1.8.15 and stems from insufficient input sanitization and output escaping of the attachments[name] parameter in the plugin's chat functionality. Unauthenticated attackers can inject arbitrary web scripts that execute when any user accesses an affected page. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browsers of administrators and site visitors, enabling session theft, account takeover, and arbitrary administrative actions.

Affected Products

VikBooking Hotel Booking Engine & PMS plugin for WordPress — all versions up to and including 1.8.15
Vulnerable component: chat attachment handling (site/controllers/chat.php, admin/helpers/src/chat/attachment.php, site/resources/chat.js)
Fixed in version 1.8.16

Discovery Timeline

2026-10-10 - CVE-2026-95684 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-95684

Vulnerability Analysis

The vulnerability resides in the chat attachment feature of the VikBooking plugin. When a chat message with an attachment is submitted, the attachments[name] parameter is accepted from client input and stored without adequate sanitization. The stored value is later rendered into pages served to users without proper output encoding, allowing injected markup and script content to execute in the browser.

Because the injection is persistent, each subsequent page load that reads the stored attachment metadata triggers the payload. The scope change in the CVSS vector reflects that the injected script executes in a security context different from the vulnerable component, affecting any authenticated administrator who views the chat interface.

Root Cause

The root cause is missing input sanitization on the attachments[name] parameter during chat submission processing and missing output escaping when that filename is rendered back into the DOM through the chat JavaScript resource. The attachment handling code paths in site/controllers/chat.php (lines 181 and 197) and the rendering logic in site/resources/chat.js (lines 712 and 916) treat attacker-controlled attachment names as safe content.

Attack Vector

An unauthenticated remote attacker submits a crafted chat message containing a malicious attachments[name] value. The payload is persisted server-side. When an administrator or any user with access to the chat interface loads the affected page, the stored script executes in the context of the WordPress site. This can be used to hijack administrator sessions, create rogue accounts, modify plugin configuration, or pivot into further compromise of the booking system. No authentication or user interaction beyond viewing the injected page is required.

See the Wordfence Vulnerability Analysis #40092 and the VikBooking Chat Attachment Code for technical references.

Detection Methods for CVE-2026-95684

Indicators of Compromise

Chat attachment records in the WordPress database containing HTML tags, <script> elements, javascript: URIs, or event handler attributes such as onerror= or onload= within attachment filename fields.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading the VikBooking chat view.
New WordPress administrator accounts, modified user roles, or unauthorized changes to VikBooking configuration without a corresponding admin action log entry.

Detection Strategies

Review HTTP POST requests to VikBooking chat endpoints for attachments[name] parameter values that include angle brackets, quotes, or script-related keywords.
Audit the wp_vikbooking_* chat tables for attachment names containing non-filename characters or encoded script payloads.
Deploy a Web Application Firewall (WAF) rule to flag chat submissions where the attachment name field does not conform to a safe filename pattern.

Monitoring Recommendations

Enable WordPress audit logging for plugin configuration changes, user creation, and role modifications.
Monitor browser Content Security Policy (CSP) violation reports originating from pages that render the VikBooking chat widget.
Alert on anomalous administrative session activity, including logins from new IP addresses or user agents following chat interface access.

How to Mitigate CVE-2026-95684

Immediate Actions Required

Update the VikBooking Hotel Booking Engine & PMS plugin to version 1.8.16 or later on all WordPress sites immediately.
Audit existing chat attachment records for stored payloads and sanitize or purge any entries containing script content.
Rotate credentials for WordPress administrator accounts that may have accessed the chat interface while the vulnerable version was installed.

Patch Information

The vendor addressed the vulnerability in VikBooking version 1.8.16. The fix is visible in the updated chat.js at line 916 for v1.8.16, which applies proper output escaping to attachment name values before rendering them into the DOM. Site owners should apply the update through the WordPress plugin updater or by downloading the latest release from the WordPress Plugin Directory.

Workarounds

If immediate patching is not possible, disable the VikBooking plugin until the update can be applied.
Restrict access to the chat endpoints via WAF rules or .htaccess IP allow-listing to limit unauthenticated submissions.
Implement a strict Content Security Policy that disallows inline scripts on pages rendering the VikBooking chat interface to reduce exploit impact.

bash

# Example WAF rule concept (ModSecurity) to block script content in attachment name
SecRule ARGS:'attachments[name]' "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1009684,phase:2,deny,status:403,msg:'CVE-2026-95684 VikBooking XSS attempt'"