Skip to content
OpenAdvisories

Product · ThimPress

WP Hotel Booking

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-15464

    WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute

    The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for a…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 6.1
    CVE-2026-15094 Scanner template

    WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter

    The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unau…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 5.3
    CVE-2026-11901

    WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler

    The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the `web_hook_process_paypal_standard()` IPN handler selecting its PayPal validation endpoint…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 6.1
    CVE-2026-11392

    WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters

    The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This make…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 5.3
    CVE-2025-14075

    WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter

    The WP Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.7. This is due to the plugin exposing the 'hotel_booking_fetch_customer_info' AJAX action to unauthenticated users without prop…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 4.3
    CVE-2025-63012

    WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.2.8.

    ThimPress WP Hotel Booking
  • Medium 4.3
    CVE-2025-63013

    WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedded Sensitive Data.This issue affects WP Hotel Booking: from n/a through <= 2.2.7.

    ThimPress WP Hotel Booking
  • Medium 5.9
    CVE-2025-63011

    WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows DOM-Based XSS.This issue affects WP Hotel Booking: from n/a through <= 2.2.8.

    ThimPress WP Hotel Booking
  • Medium 4.3
    CVE-2025-47448

    WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.1.9.

    ThimPress WP Hotel Booking
  • Medium 4.3
    CVE-2024-13447

    WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval

    The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated att…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 5.3
    CVE-2024-12370

    WP Hotel Booking <= 2.1.5 - Missing Authorization

    The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms wit…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 6.5
    CVE-2024-30508

    WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.

    ThimPress WP Hotel Booking
  • Medium 4.3
    CVE-2020-36757

    WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass

    The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incorrect nonce validation on the admin_add_order_item() function. This makes it possible for unauthentic…

    ThimPress WP Hotel Booking Web / CMS
  • Medium 4.3
    CVE-2021-36852

    WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress.

    ThimPress WP Hotel Booking