CVE-2025-57938

WordPress Easy Hotel Booking plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Sep 22, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through <= 1.9.0.

Analysis

AI-generated

Technical impact

The vulnerability stems from improper neutralization of user-supplied input during page generation, enabling DOM-based Cross‑Site Scripting. An attacker can inject malicious JavaScript that executes in the browser of anyone who views the affected page, potentially leading to cookie theft, session hijacking, defacement, or other client‑side attacks. This weakness is classified as CWE‑79.

Affected Systems

WordPress Easy Hotel Booking plugin Easy Hotel Booking (by themewant) version 1.9.0 and earlier. Any WordPress site that has the plugin installed and has not upgraded beyond that release is susceptible.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is web‑based, requiring an adversary to embed a malicious payload in the plugin’s input fields or URLs that trick a user’s browser into executing the injected script.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Easy Hotel Booking plugin to a version newer than 1.9.0 that addresses the XSS flaw.
  • If an update is unavailable, remove or disable the plugin to eliminate the vulnerable code paths.
  • Apply application‑level safeguards such as a content‑security‑policy that blocks inline scripts and restricts the data that can be stored or echoed by the plugin.

Generated by OpenCVE AI on April 30, 2026 at 00:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-30681 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking allows DOM-Based XSS. This issue affects Easy Hotel Booking: from n/a through 1.6.9.
History
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through <= 1.9.0.
Title WordPress Easy Hotel Booking plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerability WordPress Easy Hotel Booking plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through <= 1.9.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2.
Title WordPress Easy Hotel Booking plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability WordPress Easy Hotel Booking plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerability
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking allows DOM-Based XSS. This issue affects Easy Hotel Booking: from n/a through 1.6.9. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based XSS.This issue affects Easy Hotel Booking: from n/a through <= 1.9.0.
Title WordPress Easy Hotel Booking Plugin <= 1.6.9 - Cross Site Scripting (XSS) Vulnerability WordPress Easy Hotel Booking plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking allows DOM-Based XSS. This issue affects Easy Hotel Booking: from n/a through 1.6.9.
Title WordPress Easy Hotel Booking Plugin <= 1.6.9 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Earlier changes (1)
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Aug 22, 2025, 11:36 AM

View source JSON

Updated
Sep 23, 2025, 3:40 PM

JSON

Status
Deferred
Published
Sep 22, 2025, 7:15 PM
Modified
Jun 17, 2026, 9:43 AM

View source JSON

No data.

Updated
Apr 30, 2026, 1:00 AM

JSON