# CVE-2026-42762: e4jvikwp VikBooking Hotel Booking Engine DOM XSS

Source: https://junglewise.ai/threats/cve-2026-42762-e4jvikwp-vikbooking-hotel-booking-engine-dom-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-42762 · Severity: high · CVSS 7.1 · Published 2026-05-27

VikBooking is a popular WordPress plugin used by hotels and property managers to handle online reservations and room management. A security vulnerability in this plugin could allow an attacker to execute malicious scripts in the browser of a legitimate user, such as a site administrator or a customer. This could lead to unauthorized access to sensitive booking data, session hijacking, or the defacement of the website.

Technologies: [E4jvikwp VikBooking Hotel Booking Engine & PMS](https://junglewise.ai/threats/technologies/vikbooking-hotel-booking-engine-pms). Vendors: [E4jvikwp](https://junglewise.ai/threats/vendors/e4jvikwp).

## Quick answers

**Is CVE-2026-42762 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42762 being exploited in the wild.

**How severe is CVE-2026-42762?** High severity, with a CVSS score of 7.1, published 27 May 2026.

**Which products and versions are affected?** E4jvikwp VikBooking Hotel Booking Engine & PMS <= 1.8.9.

**Is there a fix for CVE-2026-42762?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42762 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42762?** Check whether you run E4jvikwp VikBooking Hotel Booking Engine & PMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the VikBooking Hotel Booking Engine & PMS plugin (versions up to and including 1.8.9). The flaw stems from improper neutralization of user-supplied input during web page generation, specifically within the Document Object Model (DOM) environment. An unauthenticated remote attacker can exploit this by tricking a user into clicking a specially crafted link. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to credential theft or unauthorized administrative actions.

## Affected products

- e4jvikwp VikBooking Hotel Booking Engine & PMS <= 1.8.9

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory

## References

- [https://patchstack.com/database/Wordpress/Plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [VikBooking Hotel Booking Engine reflected XSS](https://junglewise.ai/threats/cve-2026-95591-improper-neutralization-of-input-during-web-page-generation-cross)
- [e4jvikwp VikBooking Hotel Booking Engine & PMS Reflected XSS](https://junglewise.ai/threats/cve-2026-15346-e4jvikwp-vikbooking-hotel-booking-engine-pms-reflected-xss)
- [VikBooking Hotel Booking Engine & PMS Stored XSS in email parameter](https://junglewise.ai/threats/cve-2026-6820-vikbooking-hotel-booking-engine-pms-stored-xss-in-email-parameter)
- [VikBooking Hotel Booking Engine & PMS Stored XSS in special_requests](https://junglewise.ai/threats/cve-2026-6818-vikbooking-hotel-booking-engine-pms-stored-xss-in-special-requests)
- [e4jvikwp VikBooking Hotel Booking Engine CSRF to file deletion](https://junglewise.ai/threats/cve-2026-57723-e4jvikwp-vikbooking-hotel-booking-engine-csrf-to-file-deletion)