wp_hotel_booking 漏洞

中危CVE-2026-150942026/07/28

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

wp_hotel_bookingPoC 已收录

CVSS—

严重CVE-2023-56522026/05/05

WP Hotel Booking <= 2.0.7 - SQL Injection

WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admin_init, letting unauthenticated users perform SQL injections, exploit requires no authentication.

wp_hotel_bookingPoC 已收录

CVSS—

严重CVE-2024-36052026/02/26

WP Hotel Booking <= 2.1.0 - SQL Injection

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

wp_hotel_bookingPoC 已收录

CVSS—

严重CVE-2020-290472021/03/03

WP Hotel Booking < 1.10.4 - PHP Object Injection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.

wp_hotel_bookingPoC 已收录RCE

CVSS9.8EPSS 75.9%

wp_hotel_booking

关联漏洞

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

WP Hotel Booking <= 2.0.7 - SQL Injection

WP Hotel Booking <= 2.1.0 - SQL Injection

WP Hotel Booking < 1.10.4 - PHP Object Injection