Cross-Site Scripting Vulnerability in Hotel Booking Plugin by WordPress
CVE-2026-39784

7.1HIGH

Key Information:

Vendor

WordPress
Status
Hotel Booking
Vendor
CVE Published:
6 October 2026

What is CVE-2026-39784?

A security flaw in the Hotel Booking plugin for WordPress allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks. By exploiting this vulnerability in versions 3.8 or earlier, malicious actors can inject arbitrary scripts into web pages viewed by users, potentially leading to data theft or session hijacking. It is crucial for users and administrators to update their plugins to the latest version to mitigate this risk.

Affected Version(s)

Hotel Booking <= 3.8

References

https://patchstack.com/database/wordpress/plugin/nd-booki...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Coopernicus | Patchstack Bug Bounty Program
.