Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
ThimpressWp Hotel Booking

13 matches found

CVE
CVE•added 2024/06/20 2:15 a.m.•103 views

CVE-2024-3605

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

10CVSS9.7AI score0.44837EPSS
CVE
CVE•added 2021/03/03 6:15 p.m.•65 views

CVE-2020-29047

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.

9.8CVSS9.8AI score0.78032EPSS
CVE
CVE•added 2022/08/22 3:15 p.m.•60 views

CVE-2021-36852

Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin

8CVSS6.1AI score0.00088EPSS
CVE
CVE•added 2024/03/29 3:15 p.m.•54 views

CVE-2024-30508

Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.

9.8CVSS6.8AI score0.00243EPSS
CVE
CVE•added 2023/11/20 7:15 p.m.•49 views

CVE-2023-5652

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections

9.8CVSS9.8AI score0.18471EPSS
CVE
CVE•added 2025/01/22 11:15 a.m.•45 views

CVE-2024-13447

The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

4.3CVSS4.3AI score0.00059EPSS
CVE
CVE•added 2023/11/20 7:15 p.m.•44 views

CVE-2023-5799

The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them

5.4CVSS5.4AI score0.00048EPSS
CVE
CVE•added 2023/11/20 7:15 p.m.•43 views

CVE-2023-5651

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts

5.4CVSS5.5AI score0.00049EPSS
CVE
CVE•added 2024/10/02 5:15 a.m.•40 views

CVE-2024-7855

The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload ar...

8.8CVSS8.9AI score0.0836EPSS
CVE
CVE•added 2025/01/17 9:15 a.m.•38 views

CVE-2024-12370

The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices.

5.3CVSS5.1AI score0.00061EPSS
CVE
CVE•added 2025/05/07 3:15 p.m.•38 views

CVE-2025-47448

Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking allows Cross Site Request Forgery. This issue affects WP Hotel Booking: from n/a through 2.1.9.

4.3CVSS4.6AI score0.0002EPSS
CVE
CVE•added 2024/11/04 2:15 p.m.•33 views

CVE-2024-51582

Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: from n/a through 2.1.4.

8.8CVSS7.9AI score0.0031EPSS
CVE
CVE•added 2023/07/12 7:15 a.m.•29 views

CVE-2020-36757

The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incorrect nonce validation on the admin_add_order_item() function. This makes it possible for unauthenticated attackers to add an order item via ...

4.3CVSS4.2AI score0.00137EPSS