CVE-2025-63013
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The WP Hotel Booking plugin (versions up to and including 2.2.7) exposes sensitive system information to an unauthorized control sphere. This may allow reading confidential data embedded in the application.
Risk Assessment
An attacker could gain access to sensitive system information, which may facilitate further attacks or expose customer data and system configuration.
Recommendation
Update the WP Hotel Booking plugin to a version later than 2.2.7. Check for any data leakage and consider a security audit of the site.
Other vulnerabilities in WP Hotel Booking
See all- CVE-2026-15152Medium
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
- CVE-2026-15149Medium
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
- CVE-2026-15464Medium
The WP Hotel Booking plugin for WordPress is vulnerable to Stored XSS via the 'widget_search' Shortcode Attribute due to insufficient input sanitization. Attackers with contributor-level access can inject arbitrary scripts, but exploitation requires browsers supporting access keys.
- CVE-2026-15094Medium
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to and including 2.3.2 due to insufficient input sanitization and output escaping.
- CVE-2026-11901Medium
The WP Hotel Booking plugin for WordPress up to version 2.3.1 fails to properly verify data authenticity in the PayPal IPN handler. An attacker can use the `test_ipn` parameter to redirect validation to PayPal sandbox and force upgrade transaction status from 'pending' to 'completed' without actual payment. Missing checks on `txn_id` uniqueness, `receiver_email`, and `mc_currency` after a `VERIFIED` response further enable exploitation.
- CVE-2026-11392Medium
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versions up to and including 2.3.1 due to insufficient input sanitization and output escaping.
- CVE-2025-63012Medium
The WP Hotel Booking plugin (up to version 2.2.8) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an authenticated user into performing unwanted operations.
- CVE-2025-63011Medium
The WP Hotel Booking plugin for WordPress contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 2.2.8.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedded Sensitive Data.This issue affects WP Hotel Booking: from n/a through <= 2.2.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS