HBook - Hotel booking system - WordPress Plugin

HBook - Hotel booking system - WordPress Plugin has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2022.

All of these findings were reported by bashu.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all HBook - Hotel booking system - WordPress Plugin vulnerabilities before they are exploited.

Most severe open issueCVSS 7.1

Booking Calendar – Event Calendar <= 1.0.2 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records


2026-07-29 23:04	HBook <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters HBook - Hotel booking system… <= 2.1.9	`CVE-2026-8143`	7.2 High	bashu	Yes
2022-10-17 00:00	Booking Calendar – Event Calendar <= 1.0.2 - Missing Authorization Booking Calendar <= 1.0.2	`N/A`	7.1 High	Anonymous	No

Showing 1–2 of 2 reports