Executive brief
VikBooking is a WordPress plugin that provides hotel booking and property management functionality. The plugin fails to validate file types or sanitize content in its live chat attachment feature, allowing unauthenticated visitors to upload malicious SVG files containing active code. When administrators view these conversations, the malicious code executes in their browser, potentially compromising their accounts and administrative access.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the live chat functionality of VikBooking, classified as CWE-79. The vulnerable component does not implement file type restrictions or content sanitization on chat attachments, allowing unauthenticated attackers to upload SVG files containing embedded JavaScript. The attack requires no authentication or user interaction beyond uploading the file; execution occurs automatically when an administrator views the affected conversation. An attacker can inject arbitrary JavaScript that executes with administrator privileges, enabling account takeover, malware injection, or other administrative abuse. The vulnerability affects versions 1.8.8 through 1.8.14 and is fixed in version 1.8.15.
Affected products
- VikBooking Hotel Booking Engine & PMS 1.8.8 to 1.8.14
Timeline
- 2026-09-16: disclosed
- 2026-09-18: advisory
- 2026-09-18: patched: Version 1.8.15 released