Unknown WP Hotel Booking vulnerabilities
8 vulnerabilities
Known vulnerabilities in Unknown WP Hotel Booking, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-8942unknownwp hotel booking+1
EPSS score0.30%
The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.CVE-2026-9822unknownwp hotel booking+1EPSS score0.34%
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.CVE-2026-15149unknownwp hotel booking+1EPSS score0.32%
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.CVE-2026-15153unknownwp hotel booking+1EPSS score0.39%
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.CVE-2026-15152unknownwp hotel booking+1EPSS score0.16%
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.CVE-2023-5799thimpresswp_hotel_booking+2EPSS score0.52%
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to themCVE-2023-5652thimpresswp_hotel_booking+2EPSS score63.71%
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injectionsCVE-2023-5651thimpresswp_hotel_booking+2EPSS score0.27%
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts