Unknown Wp Hotel Booking vulnerabilities

5 CVEs affecting Unknown Wp Hotel Booking, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15152, published 2026-08-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15153, published 2026-07-30. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel…
CVE-2026-9822, published 2026-06-19. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users'…
CVE-2026-15149, published 2026-08-06. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart…
CVE-2025-8942, published 2025-09-18. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range…
CVE-2026-15152, published 2026-08-06. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the…