WordPress wp-hotel-booking has 10 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-5652 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before | critical | 9.8 | <2.0.8 | 2.0.8 |
| CVE-2024-7855 | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() | high | 8.8 | <2.1.3 | 2.1.3 |
| CVE-2020-29047 | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operati | critical | 9.8 | <=1.10.2 | – |
| CVE-2024-3605 | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms RE | critical | 10.0 | <=2.1.0 | – |
| CVE-2023-5799 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and abov | medium | 5.4 | <2.0.8 | 2.0.8 |
| CVE-2021-36852 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress. | medium | 4.3 | <=1.10.5 | – |
| CVE-2020-36757 | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due | medium | 4.3 | <=1.10.1 | – |
| CVE-2024-13447 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_bookin | medium | 4.3 | <2.1.7 | 2.1.7 |
| CVE-2024-12370 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding r | medium | 5.3 | <2.1.6 | 2.1.6 |
| CVE-2023-5651 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package | medium | 5.4 | <2.0.8 | 2.0.8 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked