What is the CVSS score of CVE-2026-15464?

CVE-2026-15464 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Hotel Booking CVE-2026-15464

EUVD-2026-48511 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-3cx8-75px-m35q

WordPress XSS Wp Hotel Booking Wordpress Plugin Thimpress

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

Access key browser dependency raises AC to H; stored XSS requires victim page visit so UI:R; contributor auth confirmed as PR:L; scope change retained.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:54 vuln.today

CVE Published

Jul 24, 2026 - 06:52 cve.org

MEDIUM 6.4

DescriptionCVE.org

The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on browsers where access keys can be used as the payload is stored in a hidden attribute.

AnalysisAI

Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to inject persistent JavaScript via the 'widget_search' shortcode attribute, exploiting insufficient sanitization before rendering in page templates. The payload is stored in a hidden HTML attribute and executes in a victim's browser when they access the injected page, though exploitation is constrained to browsers where access key interactions can trigger hidden-attribute payloads. No public exploit code has been identified and this CVE is not listed in CISA KEV; real-world risk is lower than the CVSS 6.4 suggests due to the browser-specific prerequisite.

Technical ContextAI

This is a CWE-79 (Stored Cross-Site Scripting) flaw rooted in insufficient input sanitization and output escaping within the WP Hotel Booking plugin by ThimPress (CPE: cpe:2.3:a:thimpress:wp_hotel_booking:*:*:*:*:*:*:*:*). The vulnerable code path processes the 'widget_search' shortcode attribute and passes it unsanitized to the template layer: the rendering logic in class-wphb-shortcode-hotel-booking.php (line 44) and the output in search-form.php (line 103) within the plugin's SVN tree at tags/2.3.2 confirm the injection sink. The payload is written into a hidden HTML attribute rather than a standard script context, meaning execution depends on the HTML accesskey attribute behavior - a browser accessibility feature that binds keyboard shortcuts to elements. Not all browsers expose this behavior in a way that serves as a usable XSS trigger, narrowing the realistic attack surface beyond what standard stored XSS typically presents.

RemediationAI

Update WP Hotel Booking to a version beyond 2.3.2 immediately; a fix is recorded in the plugin's SVN repository at changeset revision 3609563 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3609563%40wp-hotel-booking&new=3609563%40wp-hotel-booking) and is detailed in the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3a4258-2f45-4617-a5ca-9b28835ef405. The exact patched release version has not been independently confirmed from available data - verify against the WordPress.org plugin page before deploying. As a compensating control prior to patching, audit and restrict the contributor role to fully trusted users only, and disable the use of arbitrary shortcodes by untrusted contributors using a plugin such as Disable Gutenberg or shortcode access controls - note this may break legitimate content authored by contributors. Wordfence Premium firewall rules may provide virtual patching for this specific vector.