- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, WP Hotel Booking recorded 0 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of WP Hotel Booking and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-15464WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode AttributeCVE-2026-15094WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' ParameterCVE-2026-11901WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN HandlerCVE-2026-11392WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' ParametersCVE-2025-14075WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-15464WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-15094WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter | Exploitation statusNot exploited | FixYes | Published07/17/2026 | SeverityMedium |
|---|
CVE-2026-11901WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler | Exploitation statusNot exploited | FixYes | Published07/11/2026 | SeverityMedium |
|---|
CVE-2026-11392WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters | Exploitation statusNot exploited | FixYes | Published07/10/2026 | SeverityMedium |
|---|
CVE-2025-14075WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter | Exploitation statusNot exploited | FixYes | Published01/17/2026 | SeverityMedium |
|---|
CVE-2025-63013WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability | Exploitation statusNot exploited | FixYes | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-63012WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-63011WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-47448WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability | Exploitation statusNot exploited | FixYes | Published05/07/2025 | SeverityMedium |
|---|
CVE-2024-13447WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval | Exploitation statusNot exploited | FixYes | Published01/22/2025 | SeverityMedium |
|---|
CVE-2024-12370WP Hotel Booking <= 2.1.5 - Missing Authorization | Exploitation statusNot exploited | FixYes | Published01/17/2025 | SeverityMedium |
|---|
CVE-2024-51582WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Published11/04/2024 | SeverityHigh |
|---|
CVE-2024-7855WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload | Exploitation statusNot exploited | FixYes | Published10/02/2024 | SeverityHigh |
|---|
CVE-2024-3605WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection | Exploitation statusNot exploited | FixYes | Published06/20/2024 | SeverityCritical |
|---|
CVE-2024-30508WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Published03/29/2024 | SeverityMedium |
|---|
CVE-2020-36757WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass | Exploitation statusNot exploited | FixYes | Published07/12/2023 | SeverityMedium |
|---|
CVE-2021-36852WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixNo | Published08/22/2022 | SeverityMedium |
|---|
17 Results | Page 1 of 1