Vulnerabilities and security researches fornd-booking nd-booking

Oct 14, 2026

CVE, Research URL: CVE-2026-84166
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Oct 12, 2026
Research Description: The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Affected versions: max 3.8.
Status: vulnerable

CVE, Research URL: CVE-2026-84167
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Oct 12, 2026
Research Description: The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
Affected versions: max 3.8.
Status: vulnerable

Oct 09, 2026

CVE, Research URL: CVE-2026-39784
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Oct 06, 2026
Research Description: Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
Affected versions: max 3.8.
Status: vulnerable

Jun 15, 2026

CVE, Research URL: 4c2146fe725346efbba2f0bdb3f5e3fd2282b42b
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Aug 06, 2019
Research Description: Hotel Booking [nd-booking] < 2.4.2 WordPress Booking plugin <= 2.4 - Unauthenticated Options Change vulnerability Unauthenticated Options Change vulnerability found by Jerome Bruandet (Nintechnet) in WordPress Booking plugin (versions <= 2.4).
Affected versions: max 2.4.2.
Status: vulnerable

Jan 10, 2026

CVE, Research URL: CVE-2025-63001
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Dec 31, 2025
Research Description: Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8.
Affected versions: max 3.8.
Status: vulnerable

Jul 03, 2025

CVE, Research URL: CVE-2025-53259
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Jun 27, 2025
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.7.
Affected versions: max 3.8.
Status: vulnerable

May 09, 2025

CVE, Research URL: CVE-2025-47498
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: May 07, 2025
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.
Affected versions: max 3.7.
Status: vulnerable

Apr 19, 2025

CVE, Research URL: CVE-2025-39526
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Apr 17, 2025
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.
Affected versions: max 3.7.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2019-15774
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Aug 29, 2019
Research Description: The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Affected versions: max 2.5.
Status: vulnerable

CVE, Research URL: CVE-2022-29443
Home page URL: Security reports for Hotel Booking
Application: Hotel Booking
Date: Jun 16, 2022
Research Description: Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.
Affected versions: max 3.3.
Status: vulnerable