Medium · 4.1 CVE-2022-29443 EUVD-2022-33781GHSA-8gjc-8wm2-3h6g

WordPress Hotel Booking plugin <= 3.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Published Jun 15, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: nicdark Product: Hotel Booking (WordPress plugin) Category: Web / CMS

Description

Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.

Affected products

Vendor	Product	Affected	Fixed
Nicdark	Hotel Booking (WordPress plugin)	<= 3.0 – ≤ 3.0	—

References

https://wordpress.org/plugins/nd-booking/
https://patchstack.com/database/vulnerability/nd-booking/wordpress-hotel-booking-plugin-3-0-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities