CVE-2026-39784

8th percentile - higher than 8% of all known CVEs

The Hotel Booking plugin in versions up to 3.8 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

An attacker can inject malicious script that executes in the user's browser, potentially leading to session or data theft. The risk affects all installations of the plugin version 3.8 and earlier.

Update the Hotel Booking plugin to the latest version that does not contain the vulnerability. If updating is not possible, consider disabling the plugin until it is fixed.