CVE-2026-15401: VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vbfX custom-field value is stored via the public-facing saveorder task, which has no capability or authentication check enforced by default, enabling fully unauthenticated submission of malicious payloads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/VikBooking Hotel Booking Engine & PMSto a version that resolves this vulnerability.Fixed in 1.8.13 - Configuration
Update the plugin so that values submitted via the 'vbfX' parameter in the public-facing saveorder task are sanitized on input and escaped on output.
WordPress (VikBooking Hotel Booking Engine & PMS plugin) vbfX custom-field input sanitization and output escaping = Implement proper input sanitization and output escaping for the 'vbfX' parameter to prevent stored XSS - Configuration
Modify the plugin’s public-facing saveorder task to require an appropriate capability/authentication check so unauthenticated users cannot submit malicious 'vbfX' payloads.
WordPress (VikBooking Hotel Booking Engine & PMS plugin) public-facing saveorder capability/authentication check = Enforce capability/authentication checks
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15401?
CVE-2026-15401 has a severity rating of high at 7.2.
How do I fix CVE-2026-15401?
To fix CVE-2026-15401, upgrade the VikBooking Hotel Booking Engine & PMS plugin to version 1.8.14 or later.
What type of vulnerability is CVE-2026-15401?
CVE-2026-15401 is classified as an unauthenticated stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-15401?
All users of the VikBooking Hotel Booking Engine & PMS plugin for WordPress version 1.8.13 or earlier are affected by CVE-2026-15401.
What can attackers do with CVE-2026-15401?
Attackers can exploit CVE-2026-15401 to inject malicious scripts, leading to unauthorized actions and potential data theft.