CVE-2026-15464

Name of the Vulnerable Software and Affected Versions WP Hotel Booking versions prior to 2.3.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the widget search shortcode attribute, enabling the injection of arbitrary web scripts into pages. These scripts execute when a user accesses the affected page, provided the browser supports the use of access keys, as the payload is stored within a hidden attribute.

Recommendations Update WP Hotel Booking to a version newer than 2.3.2.