CVE-2026-6818 is a stored cross-site scripting vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin (e4jvikwp). The issue arises from improper neutralization of input in the 'special_requests' parameter, leading to injection of arbitrary web scripts. This affects all plugin versions up to and including 1.8.8. The vulnerability allows unauthenticated attackers to inject scripts that execute in the context of users viewing the injected content, potentially leading to information disclosure and session hijacking. No official patch or remediation level has been provided as of the publication date.

Successful exploitation enables an unauthenticated attacker to execute arbitrary scripts in the context of users accessing the injected pages. This can lead to partial confidentiality and integrity loss (e.g., theft of user credentials or manipulation of displayed content). There is no direct impact on availability reported. The vulnerability affects all users who view the maliciously crafted content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the 'special_requests' parameter or applying web application firewall (WAF) rules to detect and block malicious input targeting this parameter. Monitor vendor channels for updates and apply official patches promptly once released.