medium·Product Based Web Vulnerabilities·Updated Jul 21, 2026

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2026-15094

6.1

CVSSmedium

Exploitable remotely over the internet · no authentication required · user interaction needed.

Description

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Attack Vector

Network

Privileges Req.

None

User Interaction

Required

Affected

WP Hotel Bookingby thimpress

Updated Nov 10, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

Check your infrastructure.Right now.

Check your infrastructure.
Right now.