Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Careers
Contact
Book a demo

Get Started

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in Start free

Home
Vendors
Thimpress
Wp Hotel Booking

thimpress WP Hotel Booking Vulnerabilities: CVEs, CISA KEV & Security Advisories

21 CVEs

TH

thimpress WP Hotel Booking Vulnerabilities

CVE security advisories and vulnerability history for WP Hotel Booking by thimpress.

21

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

4

Public exploits

PoC or exploit code

6.6

Avg CVSS

2021–2026

Last updated July 24, 2026

Overview

thimpress WP Hotel Booking has 21 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 6.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting thimpress WP Hotel Booking, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of thimpress WP Hotel Booking's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4

High3

Medium14

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of thimpress WP Hotel Booking's CVEs are currently listed in CISA's KEV catalog.

Public exploits

4

4 of thimpress WP Hotel Booking's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every thimpress WP Hotel Booking version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 2.0.83 CVEs
<= 2.2.72 CVEs
<= 2.2.82 CVEs
<= 2.3.12 CVEs
<= 2.3.22 CVEs
>= 2.2.92 CVEs
< 1.10.21 CVE
< 2.0.9.31 CVE
< 2.1.31 CVE
< 2.1.61 CVE
< 2.1.71 CVE
<= 1.10.11 CVE
<= 1.10.21 CVE
<= 1.10.51 CVE
<= 2.0.9.21 CVE
<= 2.1.01 CVE
<= 2.1.21 CVE
<= 2.1.41 CVE
<= 2.1.51 CVE
<= 2.1.61 CVE
<= 2.1.91 CVE
<= 2.2.91 CVE
>= 2.0.9.31 CVE
>= 2.2.01 CVE
>= 2.2.81 CVE
>= 2.3.01 CVE

Fixed in

2.0.83 CVEs
2.2.92 CVEs
1.10.21 CVE
2.0.9.31 CVE
2.1.31 CVE
2.1.61 CVE
2.1.71 CVE
2.2.01 CVE
2.2.81 CVE
2.3.01 CVE

Find a version

21 CVEs

Sort

WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
CVE-2026-15464CWE-79
Medium · CVSS 6.4
EPSS 0.2% (9th pct)2026-07-24
WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter
CVE-2026-15094CWE-79
Medium · CVSS 6.1
EPSS 0.7% (51th pct)2026-07-17
WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler
CVE-2026-11901CWE-345
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-07-11
WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
CVE-2026-11392CWE-79
Medium · CVSS 6.1
EPSS 0.4% (38th pct)2026-07-10
WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
CVE-2025-14075CWE-200
Medium · CVSS 5.3
EPSS 0.3% (23th pct)2026-01-17
WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability
CVE-2025-63013
Patch
CWE-497
Medium · CVSS 4.3
EPSS 0.3% (18th pct)2025-12-09
WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2025-63012
Patch
CWE-352
Medium · CVSS 4.3
EPSS 0.1% (3th pct)2025-12-09
WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability
CVE-2025-63011
Patch
CWE-79
Medium · CVSS 5.9
EPSS 0.2% (11th pct)2025-12-09
WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability
CVE-2025-47448
Patch
CWE-352
Medium · CVSS 4.3
EPSS 0.2% (5th pct)2025-05-07
WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
CVE-2024-13447
Patch
CWE-862
Medium · CVSS 4.3
EPSS 0.4% (30th pct)2025-01-22
WP Hotel Booking <= 2.1.5 - Missing Authorization
CVE-2024-12370
Patch
CWE-284
Medium · CVSS 5.3
EPSS 0.3% (25th pct)2025-01-17
WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability
CVE-2024-51582
Patch
CWE-35
High · CVSS 8.8
EPSS 0.5% (43th pct)2024-11-04
WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
CVE-2024-7855
Patch
CWE-434
High · CVSS 8.8
EPSS 17.7% (97th pct)2024-10-02
WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
CVE-2024-3605CWE-89
Critical · CVSS 10.0
EPSS 4.2% (90th pct)2024-06-20
WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability
CVE-2024-30508
Patch
CWE-862
Critical · CVSS 9.8
EPSS 0.5% (43th pct)2024-03-29
Medium vulnerability · 2023-11-20
CVE-2023-5651
Public exploit
Patch
CWE-732
Medium · CVSS 5.4
EPSS 0.3% (20th pct)2023-11-20
WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion
CVE-2023-5799
Public exploit
Patch
CWE-863
Medium · CVSS 5.4
EPSS 0.5% (43th pct)2023-11-20
Critical vulnerability · 2023-11-20
CVE-2023-5652
Public exploit
Patch
CWE-89
Critical · CVSS 9.8
EPSS 63.7% (99th pct)2023-11-20
WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass
CVE-2020-36757
Patch
CWE-352
Medium · CVSS 4.3
EPSS 0.4% (33th pct)2023-07-12
WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability
CVE-2021-36852CWE-352
High · CVSS 8.0
EPSS 0.4% (33th pct)2022-08-22
Critical vulnerability · 2021-03-03
CVE-2020-29047
Public exploit
CWE-502
Critical · CVSS 9.8
EPSS 16.0% (97th pct)2021-03-03

Common weakness types

The CWE weakness categories most often found in thimpress WP Hotel Booking CVEs. Follow any weakness for its full explanation.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4 CVEs
CWE-352Cross-Site Request Forgery (CSRF)4 CVEs
CWE-862Missing Authorization2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVE
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVE
CWE-502Deserialization of Untrusted Data1 CVE
CWE-732Incorrect Permission Assignment for Critical Resource1 CVE

Disclosure activity by year

How many thimpress WP Hotel Booking CVEs were published each year.

2021

1

2022

1

2023

4

2024

4

2025

6

2026

5

Other thimpress products

Browse vulnerabilities for other products by thimpress.

learnpress55 CVEs LearnPress – WordPress LMS Plugin for Create and Sell Online Courses40 CVEs WP Pipes9 CVEs LearnPress Export Import6 CVEs Eduma4 CVEs LearnPress – Backup & Migration Tool4 CVEs LearnPress – WordPress LMS Plugin4 CVEs Thim Elementor Kit4 CVEs

All thimpress vulnerabilities

Frequently asked questions

Common questions about thimpress WP Hotel Booking vulnerabilities.

How many CVEs does thimpress WP Hotel Booking have?: thimpress WP Hotel Booking has 21 published CVE records since 2021.
How many thimpress WP Hotel Booking CVEs are in CISA KEV?: None of thimpress WP Hotel Booking's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for thimpress WP Hotel Booking vulnerabilities?: Yes — 4 of thimpress WP Hotel Booking's CVEs have a known public exploit.
Which versions of thimpress WP Hotel Booking are affected?: 36 distinct thimpress WP Hotel Booking versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in thimpress WP Hotel Booking CVEs?: thimpress WP Hotel Booking's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-862 (Missing Authorization), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
How many critical thimpress WP Hotel Booking vulnerabilities are there?: thimpress WP Hotel Booking has 4 critical and 3 high-severity CVEs.
What is the average severity of thimpress WP Hotel Booking CVEs?: The average CVSS base score across thimpress WP Hotel Booking's scored CVEs is 6.6.

References

All thimpress vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track thimpress WP Hotel Booking vulnerabilities

Monitor new thimpress WP Hotel Booking vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References