CVE-2026-15094 thimpress CVE debrief

Who should care

Users of the WP Hotel Booking plugin for WordPress, particularly those with versions up to 2.3.2, should be aware of this vulnerability and take steps to mitigate it. This includes updating the plugin to a version that fixes this vulnerability, if available, and implementing additional input validation and output encoding to prevent similar vulnerabilities.

Technical summary

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter. This vulnerability exists due to insufficient input sanitization and output escaping in the plugin's code. Specifically, the vulnerability is present in all versions up to, and including, 2.3.2. An attacker can exploit this vulnerability by injecting malicious scripts into the 'check_in_date' parameter, which can then be executed when a user interacts with the affected page.

Defensive priority

Medium priority should be given to addressing this vulnerability, as it allows for the injection of arbitrary web scripts.

Recommended defensive actions

• Update the WP Hotel Booking plugin to a version that fixes this vulnerability, if available.
• Implement additional input validation and output encoding to prevent similar vulnerabilities.
• Monitor for suspicious activity related to the 'check_in_date' parameter.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-17T06:16:36.367Z and has not been modified since then. The NVD entry is currently 6.1, MEDIUM severity. The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Evidence is limited to public CVE and NVD information.

Official resources