CVE-2026-11392

MEDIUM

WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-11392. PoCs published by incogbyte.

AI-analyzed exploit summary Unauthenticated reflected XSS in WP Hotel Booking plugin (<= 2.3.1) via unsanitized `check_in_date`/`check_out_date` parameters in the 'List Results Room' Elementor widget. The payload breaks out of HTML attribute context due to missing `esc_attr()` escaping, confirmed via proof-of-concept reflection test.

Description

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Exploits (1)

github WORKING POC
by incogbyte · pythonpoc
https://github.com/incogbyte/wp-cve-exploits/tree/main/CVE-2026-11392

Unauthenticated reflected XSS in WP Hotel Booking plugin (<= 2.3.1) via unsanitized `check_in_date`/`check_out_date` parameters in the 'List Results Room' Elementor widget. The payload breaks out of HTML attribute context due to missing `esc_attr()` escaping, confirmed via proof-of-concept reflection test.

Classification
Working Poc 98%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WP Hotel Booking plugin <= 2.3.1 (with Thim Elementor Kit active and 'List Results Room' widget present)
No auth needed
Prerequisites: Target page must use the 'List Results Room' Elementor widget (requires Thim Elementor Kit plugin) · At least one room with `_hb_num_of_rooms`/`_hb_room_capacity_adult` meta set (to render widget output)
mistral-large-3 · analyzed Jul 11, 2026 Full analysis →

Scores

CVSS v3 6.1
EPSS 0.0027
EPSS Percentile 18.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
thimpress/WP Hotel Booking < 2.3.1
Published Jul 10, 2026
Tracked Since Jul 10, 2026