WH
Product
WP Hotel Booking
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 3Medium 14Low 0
Watch
Add WP Hotel Booking to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-3605 | 9.8 | Jun 20 | WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection Affected: through 2.1.0 |
| CVE-2024-30508 | 9.8 | Mar 29 | WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability Affected: through 2.0.9.2 |
| CVE-2023-5652 | 9.8 | Nov 20 | WP Hotel Booking < 2.0.8 - Unauthenticated SQLi Affected: before 2.0.8 |
| CVE-2020-29047 | 9.8 | Mar 3 | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1… Affected: through 1.10.2 |
| CVE-2024-51582 | 8.8 | Nov 4 | WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability Affected: through 2.2.9 |
| CVE-2024-7855 | 8.8 | Oct 2 | WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload Affected: through 2.1.2 |
| CVE-2021-36852 | 8.0 | Aug 22 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress Affected: through 1.10.5 |
| CVE-2026-15464 | 6.4 | Jul 24 | WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute Affected: through 2.3.2 |
| CVE-2026-15094 | 6.1 | Jul 17 | WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter Affected: through 2.3.2 |
| CVE-2026-11392 | 6.1 | Jul 10 | WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters Affected: through 2.3.1 |
| CVE-2025-63011 | 5.9 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability Affected: through 2.2.8 |
| CVE-2023-5651 | 5.4 | Nov 20 | WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion Affected: before 2.0.8 |
| CVE-2023-5799 | 5.4 | Nov 20 | WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion Affected: before 2.0.8 |
| CVE-2026-11901 | 5.3 | Jul 11 | WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler Affected: through 2.3.1 |
| CVE-2025-14075 | 5.3 | Jan 17 | WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter Affected: through 2.2.7 |
| CVE-2024-12370 | 5.3 | Jan 17 | WP Hotel Booking <= 2.1.5 - Missing Authorization Affected: through 2.1.5 |
| CVE-2025-63013 | 4.3 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability Affected: through 2.2.7 |
| CVE-2025-63012 | 4.3 | Dec 9 | WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 2.2.8 |
| CVE-2025-47448 | 4.3 | May 7 | WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability Affected: through 2.1.9 |
| CVE-2024-13447 | 4.3 | Jan 22 | WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval Affected: through 2.1.6 |
| CVE-2020-36757 | 4.3 | Jul 12 | WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass Affected: before 1.10.2 |
Showing 21