CVE-2026-15401 is a stored cross-site scripting vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin affecting all versions up to 1.8.13. The vulnerability is due to improper neutralization of input in the 'vbfX' parameter, which is stored via the saveorder task that does not enforce authentication or capability checks. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 7.2, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity.

An unauthenticated attacker can inject malicious scripts via the 'vbfX' parameter that are stored and executed in the context of users visiting affected pages. This can lead to unauthorized disclosure of information and modification of data within the user's session. There is no impact on availability reported. The vulnerability affects confidentiality and integrity of user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the saveorder task if possible or implement web application firewall (WAF) rules to detect and block malicious payloads targeting the 'vbfX' parameter. Monitor vendor channels for updates and apply patches promptly once released.