Executive brief
HBook is a popular WordPress plugin used for hotel and rental booking management. A security flaw allows unauthenticated attackers to inject malicious scripts into the website's database via booking parameters. These scripts execute when an administrator views the customer management page, potentially leading to unauthorized administrative actions or the theft of sensitive session information.
Technical details
The HBook plugin for WordPress (versions up to 2.1.6) contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input sanitization and output escaping on the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' parameters. An unauthenticated attacker can send a specially crafted request containing malicious JavaScript. This script is stored in the database and later executed in the context of an authenticated user's session—specifically when an administrator accesses the HBook Customers admin page. This can lead to session hijacking or unauthorized administrative tasks.
Affected products
- Maestrel HBook Up to and including 2.1.6
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory