CVE-2026-15094: WP Hotel Booking XSS Vulnerability

CVE-2026-15094 Overview

CVE-2026-15094 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP Hotel Booking plugin for WordPress. The flaw affects all versions up to and including 2.3.2. It stems from insufficient input sanitization and output escaping of the check_in_date parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of a targeted user's session, enabling session theft, credential harvesting, or unauthorized actions on the WordPress site.

Affected Products

WP Hotel Booking plugin for WordPress — all versions through 2.3.2
WordPress sites offering booking functionality via WP Hotel Booking
Any environment exposing the plugin's room archive pages to unauthenticated visitors

Discovery Timeline

2026-07-17 - CVE-2026-15094 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-15094

Vulnerability Analysis

The vulnerability resides in how the WP Hotel Booking plugin processes the check_in_date request parameter on room archive pages. According to the WordPress plugin source, the parameter value is reflected into rendered HTML without adequate sanitization or output escaping. An attacker who crafts a URL containing a malicious payload in check_in_date can cause arbitrary JavaScript to execute in the victim's browser session. Because the plugin exposes booking search functionality to unauthenticated visitors, no authentication is required to deliver the payload. The attack requires user interaction — typically clicking a phishing link or visiting an attacker-controlled page that redirects to the vulnerable endpoint.

Root Cause

The root cause is missing input validation and output escaping in the plugin's template rendering logic. Helper routines in class-wphb-helpers.php and wphb-functions.php do not apply esc_attr() or esc_html() before echoing the check_in_date value back into the page markup. WordPress provides these escaping primitives specifically to prevent this class of flaw.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to a vulnerable room archive page containing a JavaScript payload in the check_in_date query parameter. The attacker delivers the URL through phishing email, social media, or an embedded link on an attacker-controlled site. When a victim clicks the link, the plugin reflects the malicious payload into the page HTML and the browser executes it. Because the CVSS scope is changed, the injected script can affect resources beyond the immediately vulnerable component, including authenticated administrator sessions.

// No verified proof-of-concept code is publicly available.
// See the Wordfence advisory and WordPress source references for technical details.

Detection Methods for CVE-2026-15094

Indicators of Compromise

HTTP requests to WP Hotel Booking room archive URLs containing script tags, javascript: URIs, or event handlers such as onerror= in the check_in_date parameter.
Web server access logs showing URL-encoded payloads (e.g., %3Cscript%3E) in query strings targeting booking pages.
Unexpected outbound requests from administrator browsers to unknown domains shortly after visiting booking pages.
Referer headers pointing to unfamiliar phishing domains preceding requests to the vulnerable endpoint.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the check_in_date parameter for HTML tags, JavaScript keywords, and known XSS payloads.
Monitor for anomalous query string lengths and non-date values submitted to booking endpoints.
Correlate WordPress admin session activity with prior visits to room archive URLs containing suspicious parameters.
Review WordPress plugin inventory to identify installations of WP Hotel Booking at version 2.3.2 or lower.

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress front end and retain logs for at least 90 days.
Alert on Content Security Policy (CSP) violation reports originating from booking-related pages.
Track administrator account activity for unauthorized post creation, plugin installation, or user privilege changes following link clicks.

How to Mitigate CVE-2026-15094

Immediate Actions Required

Update the WP Hotel Booking plugin to the version released after 2.3.2 as soon as the vendor patch becomes available. Refer to the WordPress Changeset Overview for the fix.
Audit administrator accounts for suspicious activity and rotate credentials if compromise is suspected.
Deploy a restrictive Content Security Policy that blocks inline script execution on booking pages.

Patch Information

The WordPress plugin repository has published a changeset addressing the sanitization gap. Site operators should apply the patched release referenced in the Wordfence Vulnerability Report and verify the plugin version after upgrade.

Workarounds

Temporarily deactivate the WP Hotel Booking plugin until the patched version is installed.
Configure a WAF rule to reject requests where check_in_date contains characters outside the expected date format (e.g., digits and hyphens).
Restrict access to booking pages behind authentication or geographic filtering if the site's use case permits.

bash

# Example ModSecurity rule to block non-date values in check_in_date
SecRule ARGS:check_in_date "!@rx ^[0-9]{4}-[0-9]{2}-[0-9]{2}$" \
  "id:1015094,phase:2,deny,status:403,\
  msg:'CVE-2026-15094: Invalid check_in_date parameter',\
  tag:'xss',tag:'wp-hotel-booking'"