CVE-2026-15094

Name of the Vulnerable Software and Affected Versions WP Hotel Booking versions prior to 2.3.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the check in date parameter, which then executes in the user's browser.

Recommendations Update WP Hotel Booking to version 2.3.3 or later. As a temporary mitigation, restrict or sanitize the input received by the check in date parameter.