CVE WatchJul 1, 2026

CVE-2026-12754

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' paramet

CVSS

6.1

Medium

EPSS

0.4%

p31

KEV

—

Exploit Today

0-100

Published: Jul 1, 2026 · Last modified: Jul 1, 2026 · CWE-79

EPSS · 30d

0.2%EPSS · 30 days0.4%

2026-08-202026-09-18

Technical description

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to render the [vikbooking view="roomslist"] shortcode, as the vulnerable layoutstyle parameter is only processed in that view context.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-929868.8 HIG

35.2%

——11SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.1d CVE-2026-634598.7 HIG

22.0%

——7Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.23h CVE-2026-909867.1 HIG

7.8%

——2Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.23h CVE-2026-908877.1 HIG

7.8%

——2Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.23h CVE-2026-782946.5 MED

5.7%

——2Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.23h CVE-2026-666176.5 MED

5.7%

——2Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.23h