CVE-2025-63011

Name of the Vulnerable Software and Affected Versions ThimPress WP Hotel Booking versions prior to 2.2.9

Description Insufficient input sanitization and output escaping allow for DOM-Based and Stored Cross-Site Scripting (XSS), a condition where malicious scripts are injected into web pages. This issue affects multi-site installations and environments where unfiltered html has been disabled. Authenticated attackers with editor-level access or higher can inject arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update ThimPress WP Hotel Booking to version 2.2.9 or later.