Beds24 Online Booking

Beds24 Online Booking has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 7 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (86%). Other recurring categories include PHP Remote File Inclusion.

Every one of the 7 issues recorded for Beds24 Online Booking has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by João Pedro Soares de Alcântara. Beds24 Online Booking is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Beds24 Online Booking vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-32155

Beds24 Online Booking <= 2.0.28 - Authenticated (Contributor+) Local File Inclusion

Read the full analysis

Vulnerability Records

7 records


2025-05-07 00:00	Beds24 Online Booking <= 2.0.29 - Authenticated (Contributor+) Stored Cross-Site Scripting Beds24 Online Booking <= 2.0.29	`CVE-2025-47489`	6.4 Medium	Peter Thaleikis	Yes
2025-04-04 00:00	Beds24 Online Booking <= 2.0.28 - Authenticated (Contributor+) Local File Inclusion Beds24 Online Booking <= 2.0.28	`CVE-2025-32155`	8.8 High	João Pedro Soares de Alcântara	Yes
2025-04-01 00:00	Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting Beds24 Online Booking <= 2.0.27	`CVE-2025-31851`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2024-11-20 13:55	Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode Beds24 Online Booking <= 2.0.27	`CVE-2024-10177`	6.4 Medium	Peter Thaleikis	Yes
2024-11-01 00:00	Beds24 Online Booking <= 2.0.25 - Authenticated (Administrator+) Stored Cross-Site Scripting Beds24 Online Booking <= 2.0.25	`CVE-2024-51664`	4.4 Medium	Roby Firnando Yusuf	Yes
2024-01-31 00:00	Beds24 Online Booking <= 2.0.23 - Authenticated(Administrator+) Stored Cross-Site Scripting Beds24 Online Booking <= 2.0.23	`CVE-2024-24717`	4.4 Medium	Dhabaleshwar Das	Yes
2024-01-08 00:00	Beds24 Online Booking <= 2.0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting Beds24 Online Booking <= 2.0.24	`CVE-2023-52228`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes

Showing 1–7 of 7 reports

Latestv2.0.30

Beds24 Online Booking

Author

markkinchin

4.3(6)

86/100

Last Updated

2025-05-02 (1y ago)

Active Installs

2,000+

Downloads

109,397

Requires WP

2.0.2+

Requires PHP

Tested up to

WP 6.7.7

Created

2012-10-29 (14y ago)

Powerful and Customisable Online Booking System Beds24.com is a full featured online booking engine. The system is very flexible with many options for customization. The Beds24.com online booking system and channel manager is suitable for any type of accommodation such as hotels, motels, B&B’s, hostels, vacation rentals, holiday homes and campgrounds as well as selling extras like tickets or tours. The plugin is free to use but you do need an account with Beds24.com. A free trial account is available at http://www.beds24.com/join.html Features Real-time availability and commission free online bookings Customisable booking widgets Multiple rates and discounts Multi language booking page (30+languages) Online payments Optional channel manager Multi-language support Features for Property Managers, Hotel Groups and Agencies Agency seach box Subaccounts with access control

View on WordPress.org