CVE-2026-12754 is a reflected Cross-Site Scripting vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin. The issue exists in the 'layoutstyle' parameter processed within the 'roomslist' view context of the [vikbooking] shortcode. Due to improper neutralization of input during web page generation, unauthenticated attackers can inject malicious scripts that execute in the context of users who interact with crafted links or actions. This vulnerability affects all plugin versions up to and including 1.8.12. No official patch or remediation level has been published as of the data provided.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to information disclosure or session hijacking. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity with no direct impact on availability. The CVSS score of 6.1 reflects a medium severity level with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid rendering the [vikbooking view="roomslist"] shortcode with untrusted input in the 'layoutstyle' parameter. Applying input validation or disabling the vulnerable shortcode usage can reduce risk. Monitor vendor channels for updates and patches addressing this vulnerability.