Medium
CVE-2026-15153
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 28
Reset filters
Medium
CVE-2026-15464
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
Medium
CVE-2026-15149
Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation
Medium
CVE-2026-15094
WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter
Medium
CVE-2026-11901
WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler
Medium
CVE-2026-11392
WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
Medium
CVE-2026-15152
Hotel Booking <= 2.3.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-9822
WP Hotel Booking < 2.3.1 - Missing Authorization
Medium
CVE-2025-14075
WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
Medium
CVE-2025-63011
Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-63013
Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure
Medium
CVE-2025-63012
Hotel Booking <= 2.2.8 - Cross-Site Request Forgery
Medium
CVE-2025-8942
WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation
Medium
CVE-2025-47448
WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery
Medium
CVE-2024-13447
WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
Medium
CVE-2024-12370
WP Hotel Booking <= 2.1.5 - Missing Authorization
High
CVE-2024-51582
WP Hotel Booking <= 2.2.9 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2024-7855
WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2024-3605
WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
Medium
CVE-2024-30508
WP Hotel Booking <= 2.0.9.2 - Missing Authorization
Medium
86f15e94-6ca7-4eb2-8a38-b4add9251dab
WP Hotel Booking <= 2.0.9.2 - Improper Authorization on Multiple REST API Routes
Critical
CVE-2023-5652
WP Hotel Booking <= 2.0.7 - Unauthenticated SQL Injection
Medium
CVE-2023-5799
WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion
Medium
CVE-2023-5651
WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.