Surbma | Booking.com Shortcode
Surbma | Booking.com Shortcode has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Surbma | Booking.com Shortcode has a vendor fix available, so running the current release closes it.
All of these findings were reported by zakaria. Surbma | Booking.com Shortcode is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-1607Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Read the full analysisVulnerability Records
Surbma | Booking.com Shortcode
Author
Surbma
A simple shortcode to include Booking.com search box into WordPress. This is a very useful plugin if your user don’t have a permission to embed javascript in the content. The shortcode: [surbma-bookingcom param="ALL_THE_PARAMETERS"] Where param is the parameter, you can find in the Booking.com embed code. You need to find the src field, where you have to copy all the parameters after the https://www.booking.com/general.html? url. You can find the parameters at the end of your Booking.com script’s url:
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C