EUVD-2026-93030
GHSA-xm7m-h5p8-v3rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload URL
-
DeliveryLure victim to click crafted link
-
ExploitPayload reflected by Hotel Booking plugin
-
ExecutionScript executes in victim browser
-
ImpactHijack session / act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the nicdark Hotel Booking WordPress plugin at versions 3.8 and earlier; per the CVSS vector it is unauthenticated (PR:N) and network-reachable, but it REQUIRES user interaction (UI:R) - a victim must open the attacker-crafted link or page for the injected script to execute. Limiting factors: the dependence on social-engineering a victim into triggering the payload, the need for the vulnerable plugin to be installed and active, and the browser-scoped (rather than server-side code execution) impact. The input description does not name the specific vulnerable parameter, endpoint, or whether the XSS is reflected or stored, so the exact injection point should be confirmed against the Patchstack advisory. |
| Impact | This is a moderate-risk reflected/stored Cross-Site Scripting issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity, unauthenticated exploitation, but the UI:R flag means a victim must be lured into triggering the payload, which meaningfully lowers real-world exploitability compared to a no-interaction flaw. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced by Patchstack - so all three exploitation-likelihood signals are either absent or negative, placing this well below actively-exploited priorities. No SSVC decision data was provided. The scope-change (S:C) and combined low C/I/A impacts are consistent with XSS executing in a victim's browser against the WordPress site context. Net: a legitimate issue to patch on a normal cycle, not a drop-everything priority, given no exploitation evidence and a required user-interaction gate. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or form input containing JavaScript that is reflected or stored by the vulnerable Hotel Booking plugin (<= 3.8) and sends it to a site visitor or administrator. When the victim loads the attacker-controlled page or parameter, the script executes in their browser session, enabling session/cookie theft or actions in the WordPress context. No public exploit code is referenced, and successful attack depends on the victim interacting with the crafted request (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated cross-site scripting in the nicdark Hotel Booking WordPress plugin affects all versions up to and including 3.8, allowing a remote attacker to inject script that executes in a victim's browser within the vulnerable site's origin. Exploitation is network-reachable and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is not automatic: per the assessed vector the attack depends on user interaction (UI:R), meaning a victim has to open a crafted link or page for the payload to fire. The assessed impact is browser-scoped (C:L/I:L/A:N with S:C), making this a moderate-risk XSS issue rather than an emergency; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
RemediationAI
No vendor-released patched version is identified in the provided data at time of analysis - the only reference is the Patchstack advisory, which should be checked for the exact fixed release before upgrading; do not assume version numbers beyond the documented '<= 3.8' affected range. Until a fix is confirmed, the most effective control is to update the plugin as soon as an advisory-backed version appears, and in the interim deactivate and delete the Hotel Booking plugin if booking functionality is not actively used (trade-off: loss of the booking feature). If the plugin must stay live, restrict exposure by putting the site behind a WAF or reverse proxy with XSS/script-injection signatures tuned to the plugin's endpoints (trade-off: potential false positives on legitimate form input and no protection for direct-to-origin traffic), and reduce the blast radius of a successful injection by enforcing a strict Content-Security-Policy that disallows inline script (trade-off: requires auditing all first- and third-party scripts on the site and can break legitimate widgets). Because exploitation requires a victim to interact with a crafted link or page, raising user awareness and ensuring administrative sessions are not used to browse untrusted links lowers risk, but these are compensating measures only, not substitutes for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is a WordPress plugin distributed under the vendor 'nicdark' and the plugin slug 'nd-booking', identified in the CPE dictionary as cpe:2.3:a:nicdark:hotel_booking. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-Site Scripting): attacker-controlled input reaches a generated HTML page without adequate encoding, so the browser parses it as script rather than text. Because the CVSS vector carries S:C (scope changed), the injected script is not confined to a single component's security context - once it runs it executes with the origin of the affected WordPress site and can act against that site's users, sessions, and pages. The vector's UI:R reflects that the payload typically has to be delivered via a crafted URL or page that a logged-in or anonymous visitor is induced to open; the provided description does not name the vulnerable parameter, endpoint, or whether the issue is reflected or stored, so the precise injection point should be confirmed against the Patchstack advisory. Note a discrepancy between the feed-reported score of 7.1 and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which drops the availability impact; the assessed vector is the authoritative one for impact characterization here.
Know when Hotel Booking gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS (PR:N) needing victim click (UI:R), script runs cross-context (S:C) with low confidentiality/integrity impact; availability impact (A:N) does not apply to typical XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
Executive ViewAI
Every version up to and including 3.8 of the nicdark Hotel Booking WordPress plugin carries an unauthenticated cross-site scripting flaw (CVE-2026-39784, CVSS 7.1) that lets an attacker run script in a visitor's browser under the hotel site's own origin. Any organization running this plugin on a public-facing booking site is in scope, and because no vendor patch exists yet, that exposure persists until the plugin is removed, disabled, or otherwise mitigated. Leadership should care because these are customer-facing booking pages where injected content can be used to harvest credentials or booking details, eroding customer trust and potentially pulling the site into scope for privacy and payment-related obligations.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the nicdark Hotel Booking plugin from internet-facing sites; virtual-patch booking pages with WAF or reverse-proxy rules that filter injected script; enforce a Content-Security-Policy that disallows inline script; set HttpOnly and Secure flags on session cookies; restrict and monitor WordPress administrator access; and scan affected pages for injected content or rogue accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB