WH
Product
WP Hotel Booking
20
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 3Medium 13Low 0
Watch
Add WP Hotel Booking to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-3605 | 9.8 | Jun 20 | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to,… Affected: through 2.1.0 |
| CVE-2024-30508 | 9.8 | Mar 29 | Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2 Affected: before 2.0.9.3 |
| CVE-2023-5652 | 9.8 | Nov 20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a… Affected: before 2.0.8 |
| CVE-2020-29047 | 9.8 | Mar 3 | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1… Affected: through 1.10.2 |
| CVE-2024-51582 | 8.8 | Nov 4 | Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: from n/a through <=… Affected: through 2.1.4 |
| CVE-2024-7855 | 8.8 | Oct 2 | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and… Affected: before 2.1.3 |
| CVE-2021-36852 | 8.0 | Aug 22 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress Affected: through 1.10.5 |
| CVE-2026-15464 | 6.4 | Jul 24 | WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute Affected: through 2.3.2 |
| CVE-2026-15094 | 6.1 | Jul 17 | WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter Affected: through 2.3.2 |
| CVE-2026-11392 | 6.1 | Jul 10 | WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters Affected: through 2.3.1 |
| CVE-2025-63011 | 5.9 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability Affected: through 2.2.8 |
| CVE-2023-5799 | 5.4 | Nov 20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no… Affected: before 2.0.8 |
| CVE-2023-5651 | 5.4 | Nov 20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing… Affected: before 2.0.8 |
| CVE-2026-11901 | 5.3 | Jul 11 | WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler Affected: through 2.3.1 |
| CVE-2025-14075 | 5.3 | Jan 17 | WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter Affected: through 2.2.7 |
| CVE-2024-12370 | 5.3 | Jan 17 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and… Affected: before 2.1.6 |
| CVE-2025-63013 | 4.3 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability Affected: through 2.2.7 |
| CVE-2025-63012 | 4.3 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 2.2.8 |
| CVE-2024-13447 | 4.3 | Jan 22 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all… Affected: before 2.1.7 |
| CVE-2020-36757 | 4.3 | Jul 12 | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1 Affected: through 1.10.1 |
Showing 20