WordPress Plugin Vulnerabilities

Hotel Booking < 3.3 - Contributor+ Stored XSS

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
nd-booking
Fixed in 3.3

References

CVE
CVE-2022-29443
URL
https://patchstack.com/database/vulnerability/nd-booking/wordpress-hotel-booking-plugin-3-0-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Ngo Van Thien
Verified
Yes
WPVDB ID
7be95383-bb2b-480e-8296-51522080cdc2

Timeline

Publicly Published
2022-05-26 (about 3 years ago)
Added
2022-06-16 (about 3 years ago)
Last Updated
2025-01-07 (about 1 year ago)

Other

Published
Title
Published
2026-02-05
Title
Docus < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2023-06-05
Title
WP Brutal AI < 2.0.1 - Admin+ Reflected XSS
Published
2019-08-10
Title
PPOM for WooCommerce <= 18.3 - Authenticated Stored XSS
Published
2023-10-25
Title
WP Simple HTML Sitemap < 2.3 - Reflected XSS
Published
2025-07-16
Title
Simple Link Directory < 14.8.1 - Reflected Cross-Site Scripting