CVE-2026-12754 is a reflected cross-site scripting vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin. The issue exists in the 'layoutstyle' parameter processed only within the context of the [vikbooking view="roomslist"] shortcode. Due to improper neutralization of input, attackers can inject malicious scripts that execute in the context of a victim's browser when they are tricked into clicking a crafted link. This affects all plugin versions up to and including 1.8.12. The vulnerability has a CVSS v3.1 base score of 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no availability impact. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure or manipulation of web content. The attack requires user interaction (clicking a crafted link) and affects confidentiality and integrity but does not impact availability. The vulnerability is limited to pages rendering the specific shortcode where the vulnerable parameter is processed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to pages using the [vikbooking view="roomslist"] shortcode or applying web application firewall (WAF) rules to detect and block malicious input targeting the 'layoutstyle' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.