This vulnerability (CVE-2026-42683) in e4jvikwp's VikBooking Hotel Booking Engine & PMS arises from improper neutralization of input during web page generation, resulting in a DOM-based Cross-site Scripting (CWE-79) flaw. It affects versions through 1.8.8 and has a CVSS 3.1 base score of 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker to inject malicious scripts into the web application’s DOM, potentially leading to unauthorized actions or data exposure within the context of a victim's browser session. No vendor-provided patch or official remediation is currently documented.

Successful exploitation of this DOM-based XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. This may allow attackers to execute arbitrary scripts in the context of the victim’s browser, potentially leading to session hijacking, unauthorized actions, or data manipulation within the application. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding controls where possible as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.