Wp Hotel Booking
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wp_hotel_booking:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wp Hotel Booking (31718306-9066-5c09-bb3b-a87f00a41952) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15149 |
vulnerable | 2026-09-16 04:33:06.824794 |
WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation
MEDIUM (5.3)
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
Published: 2026-08-06T17:07:32.684Z
Updated: 2026-08-07T14:13:01.509Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15152 |
vulnerable | 2026-09-16 04:33:06.468056 |
WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
MEDIUM (5.3)
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
Published: 2026-08-06T17:00:55.510Z
Updated: 2026-08-07T14:07:28.772Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15153 |
vulnerable | 2026-09-16 04:33:06.148676 |
WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
Published: 2026-07-30T06:00:07.520Z
Updated: 2026-07-30T18:28:25.241Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9822 |
vulnerable | 2026-07-29 01:12:09.685995 |
WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
Published: 2026-06-19T06:00:01.847Z
Updated: 2026-06-22T16:15:45.924Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8942 |
vulnerable | 2026-06-08 07:45:21.483975 |
WP Hotel Booking < 2.2.3 - Subscriber+ Rating Manipulation
The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.
Published: 2025-09-18T06:00:05.997Z
Updated: 2025-09-22T17:27:30.847Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5799 |
vulnerable | 2026-06-08 06:19:44.785951 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5652 |
vulnerable | 2026-06-08 06:19:44.378356 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5651 |
vulnerable | 2026-06-08 06:19:44.376933 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.