Executive brief
The WP Hotel Booking plugin for WordPress, which provides reservation and management features for hospitality websites, contains a security flaw that allows users with contributor-level access to inject malicious scripts into pages. These scripts execute when other users visit the affected pages, potentially leading to unauthorized actions or data theft. The vulnerability is specifically exploitable in web browsers that support access keys, as the malicious code is hidden within certain page attributes.
Technical details
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'widget_search' shortcode attribute. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into a page. The payload is stored within a hidden attribute, making it primarily exploitable on browsers where access keys can be triggered to execute the script. The vulnerability exists in all versions up to and including 2.3.2; a patch was introduced in subsequent updates (changeset 3609563).
Affected products
- ThimPress WP Hotel Booking up to, and including, 2.3.2
Timeline
- 2026-07-24: disclosed
- 2026-07-24: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/includes/shortcodes/class-wphb-shortcode-hotel-booking.php
- https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/templates/search/search-form.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3609563%40wp-hotel-booking&new=3609563%40wp-hotel-booking
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3a4258-2f45-4617-a5ca-9b28835ef405?source=cve