WP Hotel Booking CVE-2026-15464 Authenticated Stored XSS Advisory

Vulnerability Overview Vulnerability Name: WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute CVE ID: CVE-2026-15464 CVSS Score: 6.4 (Medium) Publish Date: July 23, 2026 Last Updated: July 24, 2026 Researcher: Wordfence PRISM - Wordfence Impact Scope Software Type: Plugin Software Name: wp-hotel-booking Affected Versions: <= 2.3.2 Fixed Version: 2.3.3 Remediation Recommendation: Upgrade to version 2.3.3 or a newer patched version. Additional Information Description: The WP Hotel Booking plugin contains a stored cross-site scripting (XSS) vulnerability via the 'widget_search' shortcode attribute. This vulnerability allows users with Contributor level permissions or higher to inject arbitrary scripts into pages, which are executed when users visit the compromised pages. This vulnerability is exploitable only in browsers where an access key can be used as a payload in the attribute. References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Vulnerabilities WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter - CVE ID: CVE-2026-15094 - CVSS Score: 6.1 - Researcher: Wordfence PRISM - Date: July 16, 2026 WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler - CVE ID: CVE-2026-11901 - CVSS Score: 5.3 - Researcher: valent1 - Date: July 10, 2026 WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters - CVE ID: CVE-2026-11392 - CVSS Score: 6.1 - Researcher: 1M4 - Date: July 9, 2026 WP Hotel Booking <= 2.3.1 - Missing Authorization - CVE ID: CVE-2026-9822 - CVSS Score: 4.3 - Researcher: Sanjon Keeratsinghan - Date: June 19, 2026 WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter - CVE ID: CVE-2025-14075 - CVSS Score: 5.3 - Researcher: Iftikhar Aramari (Boeing777) - Date: January 16, 2026 WP Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure - CVE ID: CVE-2025-63013 - CVSS Score: 5.3 - Researcher: daroo - Date: November 5, 2025 Hotel Booking <= 2.2.8 - Cross-Site Request Forgery - CVE ID: CVE-2025-63012 - CVSS Score: 4.3 - Researcher: daroo - Date: November 5, 2025 Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-63011 - CVSS Score: 4.4 - Researcher: daroo - Date: November 5, 2025 WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation - CVE ID: CVE-2025-6942 - CVSS Score: 4.3 - Researcher: Muhammed Çelik - Date: August 28, 2025 WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery - CVE ID: CVE-2025-47448 - CVSS Score: 4.3 - Researcher: lucky_buddy - Date: May 7, 2025 Code Blocks No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

WP Hotel Booking CVE-2026-15464 Authenticated Stored XSS Advisory

More from this source