CyberRota Analysis
AI-GeneratedThe WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'widget_search' shortcode attribute, affecting all versions up to 2.3.2. This vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious scripts that execute when users access the compromised pages, posing a risk primarily on browsers that support access keys. WordPress site administrators using this plugin should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on browsers where access keys can be used as the payload is stored in a hidden attribute.