CVE-2026-15401 describes a stored cross-site scripting vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin. The vulnerability is triggered through the 'vbfX' parameter, which is stored via the public-facing saveorder task. This task does not enforce capability or authentication checks, allowing unauthenticated attackers to submit malicious payloads. The vulnerability affects all versions up to and including 1.8.13 due to improper neutralization of input during web page generation, leading to script injection that executes in the context of users visiting the injected pages.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in the context of users visiting the affected pages. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). There is no indication of availability impact. The vulnerability could be leveraged to steal user credentials, perform actions on behalf of users, or conduct phishing attacks within the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting access to the saveorder task or implementing custom input validation and output escaping for the 'vbfX' parameter. Monitoring for suspicious input submissions and limiting exposure of the vulnerable functionality may reduce risk.