Hotel Booking
by WordPress
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-39784 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. | ||
| CVE-2025-63001 | Med | 0.34 | 5.3 | 0.00 | Dec 31, 2025 | Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8. | ||
| CVE-2026-84167 | Med | 0.28 | 4.3 | 0.00 | Oct 12, 2026 | The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal… | ||
| CVE-2026-84166 | Med | 0.28 | 4.3 | 0.00 | Oct 12, 2026 | The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
- risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8.
- risk 0.28cvss 4.3epss 0.00
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal…
- risk 0.28cvss 4.3epss 0.00
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.