CVE-2026-15094 Details.
WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
Atlas does not check this one. Needs a scripted sequence.
This check is a series of requests where each step depends on the last, often after logging in. Atlas runs single, read-only probes, so it does not run this one.
About CVE-2026-15094. What It Means.
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Product. What Is Hit.
- Vendor
- thimpress
- Product
- Thimpress WP Hotel Booking
References. Where To Read More.
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8139f512-7bc9-45ae-83d7-bf496e1ad56d
- https://wpscan.com/vulnerability/0e1602c9-8cf9-47b2-92bb-3ffd93dbe6f5
- https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/includes/TemplateHooks/ArchiveRoomTemplate.php#L262
- https://nvd.nist.gov/vuln/detail/CVE-2026-15094
FAQ
Common Questions.
WP Hotel Booking <= 2.3.2 - Cross-Site Scripting. The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
No. This check is a series of requests where each step depends on the last, often after logging in. Atlas runs single, read-only probes, so it does not run this one. The facts about CVE-2026-15094 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-15094 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Thimpress WP Hotel Booking to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-15094. Atlas does not run a check for it, so nothing here says whether a particular site is affected.