WH
Product
WP Hotel Booking
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 3Medium 14Low 0
Watch
Add WP Hotel Booking to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-15464 | 6.4 | Jul 24 | WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute Affected: through 2.3.2 |
| CVE-2026-15094 | 6.1 | Jul 17 | WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter Affected: through 2.3.2 |
| CVE-2026-11392 | 6.1 | Jul 10 | WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters Affected: through 2.3.1 |
| CVE-2025-63011 | 5.9 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability Affected: through 2.2.8 |
| CVE-2023-5799 | 5.4 | Nov 20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no… Affected: before 2.0.8 |
| CVE-2023-5651 | 5.4 | Nov 20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing… Affected: before 2.0.8 |
| CVE-2026-11901 | 5.3 | Jul 11 | WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler Affected: through 2.3.1 |
| CVE-2025-14075 | 5.3 | Jan 17 | WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter Affected: through 2.2.7 |
| CVE-2024-12370 | 5.3 | Jan 17 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and… Affected: before 2.1.6 |
| CVE-2025-63013 | 4.3 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability Affected: through 2.2.7 |
| CVE-2025-63012 | 4.3 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 2.2.8 |
| CVE-2025-47448 | 4.3 | May 7 | WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability Affected: through 2.1.9 |
| CVE-2024-13447 | 4.3 | Jan 22 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all… Affected: before 2.1.7 |
| CVE-2020-36757 | 4.3 | Jul 12 | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1 Affected: through 1.10.1 |
Showing 14