CVE-2026-85127

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15

Description Unauthenticated visitors can attach unrestricted file types to the live chat feature. Because the plugin fails to sanitize the contents of these attachments, an attacker can store active content that executes in the context of an administrator when they view the conversation. This is a stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the server and served to other users.

Recommendations Update the VikBooking Hotel Booking Engine & PMS WordPress plugin to version 1.8.15 or later.