VulnSocial

CVE-2026-15094Disclosure

LOWCVSS 6.1 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-17); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-17: 2Mentions · 2026-07-21: 1PoC Mentioned / Linked · 2026-07-21: 1Technical Details · 2026-07-17: 2Technical Details · 2026-07-21: 107-1707-21
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-172
Disclosure2
2026-07-211
Disclosure1
Full discourse3 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-15094 - medium 🚨 WP Hotel Booking <= 2.3.2 - Cross-Site Scripting > The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scrip... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-15094 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces a medium‑severity XSS vulnerability (CVE‑2026‑15094) affecting WP Hotel Booking plugin (<=2.3.2) and links to a discovery library, but does not reference an exploit, patch, or active exploitation.

    00001249
    1.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-15094 The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.… https://www.cve.org/CVERecord?id=CVE-2026-15094 ----- Traducción: CVE-2026-15094 El … http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-15094, noting a reflected XSS flaw in the WP Hotel Booking plugin that targets the 'check_in_date' parameter, without mentioning PoC, exploit code, active exploitation, or remediation.

    0000023
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-15094 The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.… https://www.cve.org/CVERecord?id=CVE-2026-15094

    Post summary

    WP Hotel Booking plugin is vulnerable to reflected XSS via the 'check_in_date' parameter (CVE-2026-15094).

    00000497
    57.8K followersView on X

Explore more

Back to dashboard