Skip to contentUnknown Hotel Booking vulnerabilities
- nicdark hotel bookingHotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDORCVE-2026-841674.3 Medium
- nicdark hotel bookingHotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRFCVE-2026-841664.3 Medium
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentCVE-2026-851278.8 High
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDORCVE-2026-152385.4 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST EndpointCVE-2026-152375.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price ManipulationCVE-2026-151495.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment BypassCVE-2026-151525.3 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX ActionCVE-2026-152354.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List SearchCVE-2026-151536.8 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX HandlersCVE-2026-98226.5 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.2.3 - Subscriber+ Rating ManipulationCVE-2025-89429.1 Critical
- e4jvikwp vikbooking hotel booking engine & pms, vikwp vikbooking hotel booking engine \& pms +1 moreVikBooking < 1.7.2 - Admin+ Stored XSSCVE-2024-136164.8 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikbooking hotel booking engine, vikwp vikbooking hotel booking engine \& pms +2 moreVikBooking < 1.6.8 - Broken Access ControlCVE-2024-27495.9 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikwp vikbooking hotel booking engine \& pms +1 moreVikBooking < 1.6.8 - Insecure Direct Object ReferencesCVE-2024-24418.1 High
- jetmonsters hotel booking liteHotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & DeletionCVE-2023-59919.8 Critical
- thimpress wp hotel bookingWP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post DeletionCVE-2023-56515.4 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post DeletionCVE-2023-57995.4 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.0.8 - Unauthenticated SQLiCVE-2023-5652EPSS 63.7%9.8 Critical
- e4jvikwp vikbooking hotel booking engine & pms, vikwp vik booking +1 moreVikBooking < 1.5.9 - Reflected Cross-Site ScriptingCVE-2022-15286.1 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikwp hotel booking engine \& pms +1 moreVikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File UploadCVE-2022-14097.2 High
- e4jvikwp vikbooking hotel booking engine & pms, vikwp hotel booking engine \& pms +1 moreVikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site ScriptingCVE-2022-14084.8 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikwp hotel booking engine \& pms +1 moreVikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRFCVE-2022-14076.5 Medium