What is the CVSS score of EUVD-2026-42786?

EUVD-2026-42786 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

WP Hotel Booking EUVD-2026-42786

| CVE-2026-11392 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 Wordfence

GHSA-8989-8rh8-rh5m

WordPress XSS Wp Hotel Booking Wordpress Plugin Thimpress

6.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS with browser scope change; PR:N as no attacker authentication required, UI:R mandatory, C/I limited to browser-context data only.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 04:29 vuln.today

CVE Published

Jul 10, 2026 - 03:31 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected cross-site scripting in the WP Hotel Booking WordPress plugin (all versions up to and including 2.3.1) permits unauthenticated remote attackers to inject arbitrary JavaScript via the check_in_date and check_out_date URL parameters across multiple search result and Elementor widget templates. Successful exploitation requires tricking a victim into clicking a crafted link, after which the injected script executes in the victim's browser context - making logged-in administrators particularly high-value targets. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

The WP Hotel Booking plugin (CPE: cpe:2.3:a:thimpress:wp_hotel_booking) by ThimPress provides hotel room search, availability, and booking functionality for WordPress sites. The reflected XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from the check_in_date and check_out_date parameters being echoed into HTML output without adequate sanitization or encoding. Source code references pinpoint at least five affected locations in version 2.3.1: the standard search loop template (templates/search/loop.php#L92), the v2 search loop (templates/search/v2/loop-v2.php#L40), the Elementor archive widget (includes/elementor/widgets/archive-room/list-results-room.php#L214), the core functions file (includes/wphb-functions.php#L748), and the helpers class (includes/class-wphb-helpers.php#L29). The breadth of affected files indicates the unsanitized parameters are passed through shared helpers and then reflected across multiple rendering paths rather than being sanitized at a single entry point.

RemediationAI

Upgrade the WP Hotel Booking plugin to version 2.3.2 or later; WordPress plugin repository references confirm that the affected template files (loop.php, loop-v2.php, list-results-room.php) were modified in the 2.3.2 tag at the same locations where the vulnerability was identified, though an explicit vendor changelog statement was not present in the provided input data. Until patching is possible, deploy a web application firewall rule - such as the Wordfence plugin's built-in firewall or a hosting-level WAF - configured to sanitize or block script-bearing content in the check_in_date and check_out_date GET/POST parameters; note that WAF rules are a mitigating control only and can potentially be bypassed via encoding variants. Administrators should also consider temporarily restricting public access to room search and listing pages if the feature is not operationally critical. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8b56ca04-c6eb-401f-aa8a-b933c0527e51 for the latest vendor guidance.