CVE-2026-11392
MEDIUMWP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-11392. PoCs published by incogbyte.
AI-analyzed exploit summary Unauthenticated reflected XSS in WP Hotel Booking plugin (<= 2.3.1) via unsanitized `check_in_date`/`check_out_date` parameters in the 'List Results Room' Elementor widget. The payload breaks out of HTML attribute context due to missing `esc_attr()` escaping, confirmed via proof-of-concept reflection test.
Description
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Exploits (1)
Unauthenticated reflected XSS in WP Hotel Booking plugin (<= 2.3.1) via unsanitized `check_in_date`/`check_out_date` parameters in the 'List Results Room' Elementor widget. The payload breaks out of HTML attribute context due to missing `esc_attr()` escaping, confirmed via proof-of-concept reflection test.
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N