Junglewise Threat Intelligence

CVE-2026-15094: ThimPress WP Hotel Booking reflected XSS in check_in_date

CVE-2026-15094 · Severity: medium · CVSS 6.1 · Published 2026-07-17

Vendors: ThimPress.

Executive brief

The WP Hotel Booking plugin for WordPress, which manages room reservations and bookings, is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. This occurs when a user is tricked into clicking a specially crafted link, potentially leading to unauthorized actions or the theft of sensitive session information. Business operations could be impacted if administrative users are targeted, leading to site compromise.

Technical details

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of the 'check_in_date' input parameter during web page generation. The vulnerability exists in versions up to and including 2.3.2 because the plugin fails to sufficiently sanitize input and escape output in components such as ArchiveRoomTemplate.php. An unauthenticated remote attacker can exploit this by tricking a user into clicking a malicious link containing a crafted payload. If successful, the attacker can execute arbitrary JavaScript in the context of the victim's browser session, which can be used to hijack sessions or perform actions on behalf of the user. A changeset (3609563) indicates that a fix has been developed.

Affected products

  • ThimPress WP Hotel Booking up to, and including, 2.3.2

Timeline

  • 2026-07-17: advisory: NVD publication date

References