CVE-2022-29443

WordPress Hotel Booking plugin <= 3.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Medium4.1EPSS 0.53%

Published: 15 Jun 2022
Updated: 28 Apr 2026
Reserved: 18 Apr 2022
Assigned by: Patchstack

Description

Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.

Timeline

2022
18 Apr 2022
18 Apr 2022
ID reserved
By Patchstack
15 Jun 202258 days later
15 Jun 2022· 58 days later
Published
2026
28 Apr 20264 years later
28 Apr 2026· 4 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-29443, by who scored it
Scored by	CVSS	Score	Vector
PatchstackCNA (assigner)	3.1	Medium4.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
NVDNVD · Modified	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.53% · top 55% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.1.

Weakness

CWE-79 Cross-site Scripting (XSS) (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Nicdark · Hotel Booking (WordPress plugin)
- affected <= 3.0 – ≤ 3.0

References (2)

https://wordpress.org/plugins/nd-booking/ (opens in a new tab)x_refsource_CONFIRMx_transferred
https://patchstack.com/database/vulnerability/nd-booking/wordpress-hotel-booking-plugin-3-0-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-29443](https://trackcve.app/badge/CVE-2022-29443.svg)](https://trackcve.app/cve/CVE-2022-29443)

Record last updated 28 Apr 2026, 16:07 UTC.