medium·Product Based Web Vulnerabilities·Updated Jul 21, 2026

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

3.1k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2026-15094

6.1

CVSSmedium

Exploitable remotely over the internet · no authentication required · user interaction needed.

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Attack Vector

Network

Privileges Req.

None

User Interaction

Required

Affected

WP Hotel Bookingby thimpress

Updated Sep 9, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

Check your infrastructure.Right now.

Check your infrastructure.
Right now.