CVE-2026-15464 in WP Hotel Booking Plugin
Summary
by MITRE • 07/24/2026
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on browsers where access keys can be used as the payload is stored in a hidden attribute.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The WP Hotel Booking plugin represents a critical security vulnerability classified as stored cross-site scripting through the widget_search shortcode attribute, affecting all versions up to and including 2.3.2. This vulnerability stems from inadequate input sanitization mechanisms and insufficient output escaping procedures within the plugin's codebase, creating an exploitable condition that allows malicious actors with contributor-level privileges or higher to inject persistent malicious scripts into the WordPress environment. The flaw specifically manifests when the widget_search shortcode attribute processes user-supplied input without proper validation or encoding, enabling attackers to store malicious payloads that execute automatically during page rendering.
The technical exploitation of this vulnerability occurs through the manipulation of the widget_search shortcode parameter, where attacker-controlled input is directly embedded into HTML output without adequate sanitization. This creates a persistent XSS vector that can affect any user who accesses pages containing the injected script, making it particularly dangerous for environments where multiple users with varying permission levels interact with the plugin's functionality. The vulnerability is specifically amplified in browsers that support access key functionality, as attackers can leverage hidden attributes to store their payloads more effectively. This aligns with CWE-79, which describes cross-site scripting vulnerabilities resulting from insufficient output escaping and improper input validation.
The operational impact of this vulnerability extends beyond simple script execution, as authenticated attackers with contributor-level access can potentially escalate their privileges or gain unauthorized access to sensitive user data. The stored nature of the XSS attack means that malicious scripts persist in the database and execute automatically whenever affected pages are accessed, creating a continuous threat vector that remains active until the vulnerability is patched. This makes the vulnerability particularly concerning for hotel booking platforms that handle sensitive customer information, as attackers could potentially steal session cookies, redirect users to malicious sites, or perform other malicious activities that compromise both user privacy and system integrity.
Security practitioners should immediately implement mitigations including updating to the latest plugin version, implementing strict input validation on all shortcode parameters, and considering temporary restrictions on contributor-level user permissions for plugin functionality. Organizations should also monitor their systems for potential exploitation attempts and ensure proper output encoding is implemented throughout the application. This vulnerability demonstrates the critical importance of input sanitization and output escaping in web applications, particularly within content management systems where multiple user roles interact with plugin functionality. The issue aligns with ATT&CK technique T1548.003, which covers privilege escalation through the exploitation of insecure web application components, emphasizing the need for comprehensive security measures that protect against both initial compromise and subsequent lateral movement within affected environments.