---
title: "ThimPress WP Hotel Booking vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/thimpress/wp-hotel-booking
type: product
description: "ThimPress WP Hotel Booking has 21 published CVEs, 0 in CISA KEV and 4 with public exploits."
updated: 2026-07-24
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# ThimPress WP Hotel Booking vulnerabilities

Vendor: [ThimPress](https://radicalnotion.ai/vendor/thimpress)

- **Published CVEs:** 21
- **In CISA KEV:** 0
- **With a public exploit:** 4
- **With a patch:** 21
- **Average CVSS:** 6.6
- **First CVE:** 2021-03-03
- **Latest CVE:** 2026-07-24

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 4 |
| High | 3 |
| Medium | 14 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 4 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 4 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 2 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 2 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 |
| [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 1 |
| [CWE-732](https://radicalnotion.ai/cwe/cwe-732) | Incorrect Permission Assignment for Critical Resource | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2021 | 1 |
| 2022 | 1 |
| 2023 | 4 |
| 2024 | 4 |
| 2025 | 6 |
| 2026 | 5 |

## Affected versions (top 22 of 36)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 2.0.8 | range | 3 |
| \<= 2.2.7 | range | 2 |
| \<= 2.2.8 | range | 2 |
| \<= 2.3.1 | range | 2 |
| \<= 2.3.2 | range | 2 |
| \>= 2.2.9 | range | 2 |
| \< 1.10.2 | range | 1 |
| \< 2.0.9.3 | range | 1 |
| \< 2.1.3 | range | 1 |
| \< 2.1.6 | range | 1 |
| \< 2.1.7 | range | 1 |
| \<= 1.10.1 | range | 1 |
| 2.0.8 | patched | 3 |
| 2.2.9 | patched | 2 |
| 1.10.2 | patched | 1 |
| 2.0.9.3 | patched | 1 |
| 2.1.3 | patched | 1 |
| 2.1.6 | patched | 1 |
| 2.1.7 | patched | 1 |
| 2.2.0 | patched | 1 |
| 2.2.8 | patched | 1 |
| 2.3.0 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-15464 | WP Hotel Booking \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget\_search' Shortcode Attribute | medium | 6.4 | No | No | Yes |
| CVE-2026-15094 | WP Hotel Booking \<= 2.3.2 - Reflected Cross-Site Scripting via 'check\_in\_date' Parameter | medium | 6.1 | No | No | Yes |
| CVE-2026-11901 | WP Hotel Booking \<= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler | medium | 5.3 | No | No | Yes |
| CVE-2026-11392 | WP Hotel Booking \<= 2.3.1 - Reflected Cross-Site Scripting via 'check\_in\_date' and 'check\_out\_date' Parameters | medium | 6.1 | No | No | Yes |
| CVE-2025-14075 | WP Hotel Booking \<= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter | medium | 5.3 | No | No | Yes |
| CVE-2025-63013 | WordPress WP Hotel Booking plugin \<= 2.2.7 - Sensitive Data Exposure vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2025-63012 | WordPress WP Hotel Booking plugin \<= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2025-63011 | WordPress WP Hotel Booking plugin \<= 2.2.8 - Cross Site Scripting (XSS) vulnerability | medium | 5.9 | No | No | Yes |
| CVE-2025-47448 | WordPress WP Hotel Booking plugin \<= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2024-13447 | WP Hotel Booking \<= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval | medium | 4.3 | No | No | Yes |
| CVE-2024-12370 | WP Hotel Booking \<= 2.1.5 - Missing Authorization | medium | 5.3 | No | No | Yes |
| CVE-2024-51582 | WordPress WP Hotel Booking plugin \<= 2.2.9 - Local File Inclusion vulnerability | high | 8.8 | No | No | Yes |
| CVE-2024-7855 | WP Hotel Booking \<= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload | high | 8.8 | No | No | Yes |
| CVE-2024-3605 | WP Hotel Booking \<= 2.1.0 - Unauthenticated SQL Injection | critical | 10.0 | No | No | Yes |
| CVE-2024-30508 | WordPress WP Hotel Booking plugin \<= 2.0.9.2 - Broken Access Control vulnerability | critical | 9.8 | No | No | Yes |
| CVE-2023-5651 | WP Hotel Booking \< 2.0.8 - Subscriber+ Arbitrary Post Deletion | medium | 5.4 | No | Yes | Yes |
| CVE-2023-5799 | WP Hotel Booking \< 2.0.9 - Contributor+ Arbitrary Post Deletion | medium | 5.4 | No | Yes | Yes |
| CVE-2023-5652 | WP Hotel Booking \< 2.0.8 - Unauthenticated SQLi | critical | 9.8 | No | Yes | Yes |
| CVE-2020-36757 | WP Hotel Booking \<= 1.10.1 - Cross-Site Request Forgery Bypass | medium | 4.3 | No | No | Yes |
| CVE-2021-36852 | WordPress WP Hotel Booking plugin \<= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability | high | 8.0 | No | No | Yes |
| CVE-2020-29047 | - | critical | 9.8 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does ThimPress WP Hotel Booking have?

ThimPress WP Hotel Booking has 21 published CVE records since 2021.

### How many ThimPress WP Hotel Booking CVEs are in CISA KEV?

None of ThimPress WP Hotel Booking's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for ThimPress WP Hotel Booking vulnerabilities?

Yes — 4 of ThimPress WP Hotel Booking's CVEs have a known public exploit.

### Which versions of ThimPress WP Hotel Booking are affected?

36 distinct ThimPress WP Hotel Booking versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in ThimPress WP Hotel Booking CVEs?

ThimPress WP Hotel Booking's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-862 (Missing Authorization), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).

### How many critical ThimPress WP Hotel Booking vulnerabilities are there?

ThimPress WP Hotel Booking has 4 critical and 3 high-severity CVEs.

### What is the average severity of ThimPress WP Hotel Booking CVEs?

The average CVSS base score across ThimPress WP Hotel Booking's scored CVEs is 6.6.

## Other products from this vendor

- [LearnPress](https://radicalnotion.ai/vendor/thimpress/learnpress) (66 CVEs)
- [LearnPress – WordPress LMS Plugin for Create and Sell Online Courses](https://radicalnotion.ai/vendor/thimpress/learnpress-wordpress-lms-plugin-for-create-and-sell-online-courses) (45 CVEs)
- [WP Pipes](https://radicalnotion.ai/vendor/thimpress/wp-pipes) (9 CVEs)
- [LearnPress Export Import](https://radicalnotion.ai/vendor/thimpress/learnpress-export-import) (6 CVEs)
- [Eduma](https://radicalnotion.ai/vendor/thimpress/eduma) (4 CVEs)
- [LearnPress – Backup & Migration Tool](https://radicalnotion.ai/vendor/thimpress/learnpress-backup-and-migration-tool) (4 CVEs)
- [LearnPress – WordPress LMS Plugin](https://radicalnotion.ai/vendor/thimpress/learnpress-wordpress-lms-plugin) (4 CVEs)
- [Thim Elementor Kit](https://radicalnotion.ai/vendor/thimpress/thim-elementor-kit) (4 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/thimpress/wp-hotel-booking). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.