CVE-2026-15464: WP Hotel Booking Plugin XSS Vulnerability

CVE-2026-15464 Overview

CVE-2026-15464 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Hotel Booking plugin for WordPress. The flaw affects all versions up to and including 2.3.2 and stems from insufficient input sanitization and output escaping in the widget_search shortcode attribute. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. The scripts execute when a user accesses the affected page, though exploitation is limited to browsers where access keys can trigger payloads stored in hidden attributes. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browsers of site visitors, enabling session theft, account takeover, or content manipulation on affected WordPress sites.

Affected Products

WP Hotel Booking plugin for WordPress
All versions up to and including 2.3.2
WordPress sites where contributor-level accounts or higher are permitted

Discovery Timeline

2026-07-24 - CVE-2026-15464 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-15464

Vulnerability Analysis

The WP Hotel Booking plugin exposes a widget_search shortcode that accepts user-controlled attributes. These attributes flow into rendered HTML via the search form template without adequate sanitization or output escaping. The relevant code paths reside in includes/shortcodes/class-wphb-shortcode-hotel-booking.php and templates/search/search-form.php, where the attribute value is embedded into a hidden HTML attribute.

Because the injection point is a hidden attribute, standard event handlers do not fire on page render. Exploitation requires the browser's access key mechanism to invoke the payload, which narrows the exploitation surface but does not eliminate the risk. Once triggered, injected scripts execute in the origin of the WordPress site.

Root Cause

The root cause is a Cross-Site Scripting weakness [CWE-79] caused by missing input sanitization on shortcode attributes and missing output escaping when those attributes are written into HTML. The plugin trusts contributor-supplied content and reflects it into a hidden attribute of the search form markup without applying WordPress escaping functions such as esc_attr().

Attack Vector

An authenticated attacker with contributor-level privileges or higher creates or edits a post containing the vulnerable shortcode with a malicious attribute value. When any subsequent visitor loads the resulting page in a browser that supports access keys, activating the access key triggers the payload stored in the hidden attribute. The stored nature of the payload means the attack persists until the content is removed or the plugin is patched.

See the Wordfence Vulnerability Report and the WordPress Plugin Search Form Code for the vulnerable rendering path.

Detection Methods for CVE-2026-15464

Indicators of Compromise

Post or page content containing widget_search shortcode instances with unusual attribute values that include HTML entities, <script> fragments, or accesskey references.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages with the shortcode.
Contributor accounts creating or editing posts that embed the WP Hotel Booking search widget shortcode where none was previously used.

Detection Strategies

Audit the WordPress wp_posts table for shortcode occurrences of widget_search and inspect embedded attribute values for script content or encoded payloads.
Deploy a web application firewall rule to inspect POST requests to wp-admin/post.php and wp-admin/post-new.php for shortcode attributes containing HTML markup.
Enable WordPress activity logging to capture post creation and edit events by contributor-level accounts.

Monitoring Recommendations

Monitor plugin version inventory across WordPress sites and alert on any WP Hotel Booking installations at version 2.3.2 or earlier.
Track content publishing patterns from lower-privilege accounts, especially posts referencing hotel booking shortcodes.
Review browser console errors and Content Security Policy violation reports for unexpected script execution on public pages.

How to Mitigate CVE-2026-15464

Immediate Actions Required

Update the WP Hotel Booking plugin to a version later than 2.3.2 that includes the fix referenced in the WordPress Plugin Changeset Details.
Audit existing posts and pages for injected widget_search shortcodes and remove suspicious attribute values.
Review contributor-level and higher user accounts, and revoke or reset credentials for any accounts that show signs of unauthorized activity.

Patch Information

The WordPress.org plugin repository publishes the fix under changeset 3609563. Site administrators should upgrade the WP Hotel Booking plugin to the patched release through the WordPress admin dashboard or via WP-CLI. Verify the installed version after the update to confirm remediation.

Workarounds

Restrict contributor-level publishing rights until the plugin is updated, or temporarily deactivate the WP Hotel Booking plugin.
Deploy a Content Security Policy that blocks inline script execution to reduce the impact of successful injection.
Configure a web application firewall rule to strip or reject shortcode attributes containing HTML or JavaScript syntax on write operations.

bash

# Configuration example: identify vulnerable plugin version via WP-CLI
wp plugin get wp-hotel-booking --field=version
wp plugin update wp-hotel-booking