CVE-2026-6820 describes a stored cross-site scripting vulnerability in the VikBooking Hotel Booking Engine & PMS WordPress plugin. The vulnerability exists in the 'email' parameter, which does not properly sanitize or escape input, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other client-side impacts. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with no availability impact. No patch or official remediation has been confirmed as of the published date.

Successful exploitation allows an unauthenticated attacker to inject persistent malicious scripts that execute in the browsers of users visiting the affected pages, potentially compromising user confidentiality and integrity. There is no direct impact on availability. This can lead to theft of session tokens, defacement, or other client-side attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding at the application or web server level as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.