WP Hotel Booking Reflected XSS Advisory (CVE-2026-11392)

Vulnerability Overview Vulnerability Name: WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters CVE ID: CVE-2026-11392 CVSS Score: 6.1 (Medium) Publication Date: July 9, 2026 Last Updated: July 10, 2026 Researcher: 1M4 Impact Scope Affected Versions: WP Hotel Booking <= 2.3.1 Vulnerability Type: Reflected Cross-Site Scripting (Reflected XSS) Vulnerability Description: In WP Hotel Booking plugin versions 2.3.1 and earlier, insufficient input sanitization and output escaping result in a reflected cross-site scripting vulnerability in the and parameters. Attackers can inject arbitrary web scripts to successfully trick users into performing malicious actions, such as clicking links. Remediation Fixed Version: Upgrade to 2.3.2 or later Patch Status: Fixed Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities WP Hotel Booking < 2.3.1 - Missing Authorization (CVE-2026-9822) WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter (CVE-2025-14075) Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure (CVE-2025-63013) Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting (CVE-2025-63011) Hotel Booking <= 2.2.8 - Cross-Site Request Forgery (CVE-2025-63012) WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscribers) Rating Manipulation (CVE-2025-8942) WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery (CVE-2025-47448) WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval (CVE-2024-13447) WP Hotel Booking <= 2.1.5 - Missing Authorization (CVE-2024-12370) WP Hotel Booking <= 2.2.9 - Authenticated (Contributor+) Local File Inclusion (CVE-2024-51582) Notes This vulnerability database is completely free and can be used for personal and commercial purposes. API and Webhook documentation is provided to facilitate querying the vulnerability API endpoints and configuring webhooks. Contact For more information or to report errors, please contact: info@wordfence.com Copyright Notice This record contains copyrighted material, owned by Defiant Inc. and The MITRE Corporation. Business Hours Weekdays: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT Excluding weekends and holidays Response Time: 1 hour Social Media Twitter: @Wordfence Facebook: Wordfence LinkedIn: Wordfence Email: info@wordfence.com Other Links Terms of Service Privacy Policy and Collection Notice Do Not Sell or Share My Personal Information Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central News and Updates Blog News Vulnerability Alerts About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Subscribe to receive news and updates Disclaimer The content on this page is for reference only and does not constitute any legal or technical advice. Copyright Information © 2012-2026 Defiant Inc. All rights reserved. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intelligence. Others This page is powered by Wordfence Intellig

Goal Reached Thanks to every supporter — we hit 100%!

WP Hotel Booking Reflected XSS Advisory (CVE-2026-11392)

More from this source