CVE-2026-15346 describes a reflected Cross-Site Scripting vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin affecting all versions up to 1.8.13. The issue is due to improper neutralization of input in the 'category_id' parameter, which is not sufficiently sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject arbitrary JavaScript that executes when a user interacts with a maliciously crafted link. The vulnerability is limited to browsers supporting access keys because the injection occurs in a hidden element. No official patch or remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website for users who interact with crafted links. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no reported impact on availability. The attack requires user interaction and is constrained to browsers supporting access keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published, users should monitor for vendor updates. Until a patch is available, consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'category_id' parameter. Avoid clicking suspicious links related to the affected site. Follow vendor advisories closely for any forthcoming official fixes.