PHP
CVE-2025-63011
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows DOM-Based XSS.This issue affects WP Hotel Booking: from n/a through <= 2.2.8.
AnalysisAI
DOM-based cross-site scripting (XSS) in ThimPress WP Hotel Booking plugin versions up to 2.2.8 allows authenticated users with high privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and high administrator privileges (PR:H), limiting its real-world impact despite a moderate CVSS score of 5.9. EPSS exploitation probability is very low at 0.04%, indicating minimal practical attack likelihood.
Technical ContextAI
This is a DOM-based cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in the WP Hotel Booking WordPress plugin. DOM-based XSS occurs when untrusted user input is processed on the client side without proper sanitization and reflection back into the page's Document Object Model, allowing attackers to inject executable JavaScript. The vulnerability requires high-privilege authenticated access (administrator level) to the WordPress admin panel, meaning an attacker must already have significant control over the site. The attack vector is network-based but depends on social engineering or phishing to trick an administrator into clicking a malicious link.
Affected ProductsAI
ThimPress WP Hotel Booking WordPress plugin from version 0.0.0 through version 2.2.8 is affected. The vulnerability impacts all installations of this plugin up to and including the 2.2.8 release. More information is available in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/wp-hotel-booking/vulnerability/wordpress-wp-hotel-booking-plugin-2-2-7-cross-site-scripting-xss-vulnerability.
RemediationAI
Update the WP Hotel Booking plugin to version 2.2.9 or later. Site administrators should navigate to the WordPress Plugins dashboard, locate WP Hotel Booking, and apply the available update. For sites unable to update immediately, restrict administrative access to trusted users only and monitor admin audit logs for suspicious activity. Consult the plugin vendor's security advisory at https://patchstack.com/database/Wordpress/Plugin/wp-hotel-booking/ for additional guidance and verification that the installed version is no longer vulnerable.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today