WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
CVE-2026-15094
Verified
Description
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Affected Product
wp-hotel-booking
Published Date
July 18, 2026
Template Author
smigsbellamigs
CVE-2026-15094.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2026-15094
CWE ID:
cwe-79
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/8139f512-7bc9-45ae-83d7-bf496e1ad56dhttps://wpscan.com/vulnerability/0e1602c9-8cf9-47b2-92bb-3ffd93dbe6f5https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/includes/TemplateHooks/ArchiveRoomTemplate.php#L262https://nvd.nist.gov/vuln/detail/CVE-2026-15094
Remediation Steps
Update the WP Hotel Booking plugin to version 2.3.3 or later.