[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTpWSn4EOe0zI410FIyRnUmgtUmpNTZWvC0A5mdZRudU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":9,"research_fix_diff":34,"research_exploit_outline":35,"research_model_used":36,"research_started_at":37,"research_completed_at":38,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":39},"CVE-2026-12754","vikbooking-hotel-booking-engine-pms-reflected-cross-site-scripting-via-layoutstyle-parameter","VikBooking Hotel Booking Engine & PMS \u003C= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter","The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to render the [vikbooking view=\"roomslist\"] shortcode, as the vulnerable layoutstyle parameter is only processed in that view context.","vikbooking",null,"\u003C=1.8.12","1.8.13","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 20:07:22","2026-07-01 08:30:05",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F6d126213-e342-4271-aca0-5cc47214ae8b?source=api-prod",1,[22,23,24,25,26,27,28],"admin\u002Fcontroller.php","admin\u002Fhelpers\u002Feinvoicing\u002Fdrivers\u002Fmydata_aade.php","admin\u002Fhelpers\u002Freport\u002Frms_occupancy_pace.php","admin\u002Fhelpers\u002Fsrc\u002Fbooking\u002Fregistry.php","admin\u002Fhelpers\u002Fsrc\u002Ftaxonomy\u002Ffinance.php","admin\u002Fhelpers\u002Fwidgets\u002Fdoor_access_control.php","admin\u002Fhelpers\u002Fwidgets\u002Fnotifications_center.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-12754 (VikBooking XSS)\n\n## 1. Vulnerability Summary\nThe **VikBooking Hotel Booking Engine & PMS** plugin (versions \u003C= 1.8.12) contains a reflected cross-site scripting (XSS) vulnerability via the `layoutstyle` parameter. The vulnerability exists because the plugin fails to sanitize or escape this parameter when it is used within the context of the `roomslist` view. This view is typically triggered by the `[vikbooking view=\"roomslist\"]` shortcode. An unauthenticated attacker can inject arbitrary JavaScript by tricking a user into clicking a crafted URL targeting a page containing this shortcode.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** Any WordPress page\u002Fpost containing the `[vikbooking view=\"roomslist\"]` shortcode.\n- **Vulnerable Parameter:** `layoutstyle` (GET parameter).\n- **Authentication:** Unauthenticated (No login required).\n- **Preconditions:** A public-facing page must exist that renders the `roomslist` view via the plugin's shortcode.\n- **Payload Type:** Reflected XSS.\n\n## 3. Code Flow (Inferred from Patch and Patterns)\nBased on the vulnerability description and common patterns in the VikBooking plugin (which uses a Joomla-derived MVC architecture):\n1.  **Entry Point:** A user visits a URL like `example.com\u002Fbooking-page\u002F?view=roomslist&layoutstyle=PAYLOAD`.\n2.  **Shortcode Processing:** WordPress parses `[vikbooking view=\"roomslist\"]`. The plugin's shortcode handler initializes the frontend controller.\n3.  **Request Handling:** The controller (similar in logic to the provided `admin\u002Fcontroller.php`) retrieves the request variables using `VikRequest::getVar('layoutstyle', ...)` or directly from `$_GET`.\n4.  **View Rendering:** The controller passes execution to the `roomslist` view class. \n5.  **Sink:** Within the `roomslist` layout template, the `layoutstyle` value is echoed into the HTML (likely as a CSS class name for a wrapper div or within an input field) without being passed through `esc_attr()` or `esc_html()`.\n\n## 4. Nonce Acquisition Strategy\nReflected XSS in a GET-based view usually does **not** require a nonce in WordPress, as it is a read operation designed for public consumption. However, if the plugin's frontend controller implements a global check:\n\n1.  **Target Page:** Navigate to the page created in the \"Test Data Setup\".\n2.  **JS Variable Check:** VikBooking often localizes data. Use the following to check for nonces if the exploit fails:\n    - `browser_eval(\"window.vbo_ajax?.nonce\")`\n    - `browser_eval(\"window.VikBooking?.nonce\")`\n3.  **Bypass:** Since the description identifies this as reflected XSS via a URL parameter, it is highly likely that no nonce is required for the rendering phase.\n\n## 5. Exploitation Strategy\nThe exploit involves crafting a URL that breaks out of an HTML attribute or tag context.\n\n### Step 1: Discover\u002FCreate the Target Page\nIdentify or create a page with the specific shortcode required to trigger the vulnerable code path.\n\n### Step 2: Craft the Payload\nSince `layoutstyle` is likely reflected in a class attribute or a similar container:\n- **Simple Alert:** `\">\u003Cscript>alert(window.origin)\u003C\u002Fscript>`\n- **Attribute Breakout:** `' onmouseover='alert(1) ` (if reflected inside a single-quoted attribute)\n\n### Step 3: Execute via Browser\nUse the `browser_navigate` tool to simulate a victim clicking the link.\n\n```javascript\n\u002F\u002F Example URL for the PoC Agent\nconst targetUrl = \"http:\u002F\u002Flocalhost:8080\u002Frooms\u002F?view=roomslist&layoutstyle=\\\">\u003Cscript>confirm(document.domain)\u003C\u002Fscript>\";\n```\n\n## 6. Test Data Setup\nBefore testing, the environment must be prepared:\n1.  **Install Plugin:** Ensure VikBooking \u003C= 1.8.12 is active.\n2.  **Create Rooms:** The `roomslist` view may require at least one room to render the layout.\n    - Use `wp eval` or the plugin admin to ensure a room exists in the `_vikbooking_rooms` table.\n3.  **Create the Page:** \n    ```bash\n    wp post create --post_type=page --post_title=\"Rooms List\" --post_status=publish --post_content='[vikbooking view=\"roomslist\"]'\n    ```\n4.  **Verify Page URL:** Identify the permalink of the new page (e.g., `\u002Frooms-list\u002F`).\n\n## 7. Expected Results\n- When the crafted URL is loaded, the browser should execute the injected `\u003Cscript>`.\n- If using `confirm(document.domain)`, the automation agent should detect a dialog or the presence of the script tag in the rendered DOM.\n- The HTML source of the rendered page should contain the unescaped payload:\n  ```html\n  \u003Cdiv class=\"vbo-rooms-list-wrapper \">\u003Cscript>confirm(document.domain)\u003C\u002Fscript>\">\n  ```\n\n## 8. Verification Steps\nAfter the browser-based exploit, verify the vulnerability using `wp-cli`:\n1.  Check if the page renders the payload in the response body (simulated):\n    ```bash\n    # This is a conceptual check; the agent should use browser tools\n    curl -s \"http:\u002F\u002Flocalhost:8080\u002Frooms-list\u002F?layoutstyle=VULN_CHECK_CANARY\" | grep \"VULN_CHECK_CANARY\"\n    ```\n2.  Confirm the version is vulnerable:\n    ```bash\n    wp plugin get vikbooking --field=version\n    ```\n\n## 9. Alternative Approaches\nIf the payload `\">\u003Cscript>...` is blocked by a basic WAF or browser XSS auditor:\n1.  **Event Handler Payload:** `layoutstyle=generic-style\" onmouseover=\"alert(1)` (Requires user interaction like hovering).\n2.  **Image Tag Sink:** `layoutstyle=\">\u003Cimg src=x onerror=alert(1)>` (Self-executing).\n3.  **Context Check:** If the reflection is inside a `\u003Cscript>` block (e.g., as a JS variable), use:\n    - `layoutstyle=';alert(1);\u002F\u002F`\n4.  **View Parameter:** If the `view` parameter is also required in the URL to reach the sink, ensure the URL contains both `view=roomslist` and `layoutstyle=...`.","The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'layoutstyle' parameter in the 'roomslist' view. This occurs because the plugin fails to sanitize or escape user-supplied input before echoing it back into the page. An unauthenticated attacker can exploit this by tricking a user into clicking a crafted link, resulting in the execution of arbitrary JavaScript in the context of the user's browser.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fvikbooking\u002F1.8.12\u002Fadmin\u002Fcontroller.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fvikbooking\u002F1.8.13\u002Fadmin\u002Fcontroller.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fvikbooking\u002F1.8.12\u002Fadmin\u002Fcontroller.php\t2026-06-16 15:26:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fvikbooking\u002F1.8.13\u002Fadmin\u002Fcontroller.php\t2026-06-30 15:55:56.000000000 +0000\n@@ -13957,8 +13957,15 @@\n \t *\u002F\n \tpublic function upload_customer_document()\n \t{\n-\t\t$input = JFactory::getApplication()->input;\n+\t\t$app = JFactory::getApplication();\n+\n+\t\tif (!JSession::checkToken()) {\n+\t\t\t\u002F\u002F missing CSRF-proof token\n+\t\t\tVBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN'));\n+\t\t}\n+\n \t\t$dbo   = JFactory::getDbo();\n+\t\t$input = $app->input;\n \n \t\t$customer_id = $input->getUint('customer', 0);\n \n@@ -13979,15 +13986,13 @@\n \t\t\t\t->where($dbo->qn('id') . ' = ' . $customer_id);\n \n \t\t\t$dbo->setQuery($q, 0, 1);\n-\t\t\t$dbo->execute();\n+\t\t\t$customer = $dbo->loadObject();\n \n-\t\t\tif (!$dbo->getNumRows())\n+\t\t\tif (!$customer)\n \t\t\t{\n \t\t\t\tthrow new Exception(sprintf('Customer [%d] not found', $customer_id), 404);\n \t\t\t}\n \n-\t\t\t$customer = $dbo->loadObject();\n-\n \t\t\t\u002F\u002F fetch documents folder path\n \t\t\t$dirpath = VBO_CUSTOMERS_PATH . DIRECTORY_SEPARATOR;\n \n@@ -14044,8 +14049,7 @@\n \t\t\t$result->code  = $e->getCode();\n \t\t}\n \n-\t\techo json_encode($result);\n-\t\texit;\n+\t\tVBOHttpDocument::getInstance($app)->json($result);\n \t}\n \n \t\u002F**\n@@ -14057,8 +14061,19 @@\n \t *\u002F\n \tpublic function delete_customer_document()\n \t{\n-\t\t$input = JFactory::getApplication()->input;\n+\t\t$app = JFactory::getApplication();\n+\n+\t\tif (!JSession::checkToken()) {\n+\t\t\t\u002F\u002F missing CSRF-proof token\n+\t\t\tVBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN'));\n+\t\t}\n+\n+\t\tif (!JFactory::getUser()->authorise('core.delete', 'com_vikbooking')) {\n+\t\t\tVBOHttpDocument::getInstance($app)->close(403, JText::translate('JERROR_ALERTNOAUTHOR'));\n+\t\t}\n+\n \t\t$dbo   = JFactory::getDbo();\n+\t\t$input = $app->input;\n \n \t\t$customer_id = $input->getUint('customer', 0);\n \n@@ -14075,36 +14090,45 @@\n \n \t\tif (!$dbo->getNumRows())\n \t\t{\n-\t\t\tthrow new Exception(sprintf('Customer [%d] not found', $customer_id), 404);\n+\t\t\tVBOHttpDocument::getInstance($app)->close(404, sprintf('Customer [%d] not found', $customer_id));\n \t\t}\n \n \t\t$folder = $dbo->loadResult();\n \n \t\tif (!$folder)\n \t\t{\n-\t\t\tthrow new Exception('The customer does not have any documents', 500);\n+\t\t\tVBOHttpDocument::getInstance($app)->close(500, 'The customer does not have any documents');\n \t\t}\n \n \t\t$file = $input->getString('file');\n \n \t\tif (!$file)\n \t\t{\n-\t\t\tthrow new Exception('File to remove not specified', 400);\n+\t\t\tVBOHttpDocument::getInstance($app)->close(400, 'File to remove not specified');\n \t\t}\n \n \t\t$path = implode(DIRECTORY_SEPARATOR, array(VBO_CUSTOMERS_PATH, $folder, $file));\n \n \t\tif (!is_file($path)) \n \t\t{\n-\t\t\tthrow new Exception(sprintf('File [%s] not found', $path), 404);\n+\t\t\tVBOHttpDocument::getInstance($app)->close(404, sprintf('File [%s] not found', $path));\n \t\t}\n \n-\t\tjimport('joomla.filesystem.file');\n+\t\t\u002F**\n+\t\t * Accept only non-traversal paths under the customer docs folder.\n+\t\t * \n+\t\t * @since \t1.18.13 (J) - 1.8.13 (WP)\n+\t\t *\u002F\n+\t\t$path = realpath($path);\n+\n+\t\tif (!$path || strpos($path, VBO_CUSTOMERS_PATH) !== 0)\n+\t\t{\n+\t\t\tVBOHttpDocument::getInstance($app)->close(403, 'Path not allowed for file deletion.');\n+\t\t}\n \n \t\t$removed = JFile::delete($path);\n \n-\t\techo json_encode(array('status' => (int) $removed));\n-\t\texit;\n+\t\tVBOHttpDocument::getInstance($app)->json(array('status' => (int) $removed));\n \t}\n \n \t\u002F**","To exploit this vulnerability, an unauthenticated attacker identifies a page on the target WordPress site that renders the [vikbooking view=\"roomslist\"] shortcode. The attacker then constructs a URL targeting this page and appends the `view=roomslist` and `layoutstyle` GET parameters. The `layoutstyle` parameter is loaded with a payload designed to break out of HTML attribute or tag contexts, such as \">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\". When a victim (especially an administrator) navigates to this crafted URL, the malicious script executes within their browser session because the plugin echoes the `layoutstyle` value directly into the HTML source without proper escaping.","gemini-3-flash-preview","2026-07-25 12:31:37","2026-07-25 12:32:15",{"type":40,"vulnerable_version":41,"fixed_version":11,"vulnerable_browse":42,"vulnerable_zip":43,"fixed_browse":44,"fixed_zip":45,"all_tags":46},"plugin","1.8.12","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.13","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.13.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags"]