Skip to content
PluginCanary

WP Hotel Booking

by ThimPress · 7,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: 16 vulnerabilities published in the last 24 months.

81/ 100 Canary Score
Sub-scores for WP Hotel Booking
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • InfoSEC-316 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
ThimPress28 Feb 2016 to 2 Nov 2026, 144 commits
phamtungpth12 Nov 2018 to 21 May 2019, 10 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
21
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for WP Hotel Booking
Q1 20244
Q2 20243
Q3 20242
Q4 20243
Q1 20251
Q2 20253
Q3 20253
Q4 20255
Q1 20262
Q2 20262
Q3 20262
Q4 20261

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

0% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Jul 2026WP Hotel Booking < 2.3.2 - Authenticated (Custom role+) SQL Injection6.5< 2.3.22.3.20
23 Jul 2026WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute6.4<= 2.3.22.3.30
21 Jul 2026Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation5.3<= 2.3.22.3.30
16 Jul 2026WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter6.1<= 2.3.22.3.30
10 Jul 2026WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler5.3<= 2.3.12.3.20
9 Jul 2026WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters6.1<= 2.3.12.3.20
9 Jul 2026Hotel Booking <= 2.3.1 - Unauthenticated Payment Bypass5.3<= 2.3.12.3.20
19 Jun 2026WP Hotel Booking < 2.3.1 - Missing Authorization4.3< 2.3.12.3.10
16 Jan 2026WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter5.3<= 2.2.72.2.80
5 Nov 2025Hotel Booking <= 2.2.8 - Cross-Site Request Forgery4.3<= 2.2.82.2.993
5 Nov 2025Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 2.2.82.2.993
5 Nov 2025Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure5.3<= 2.2.72.2.855
28 Aug 2025WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation4.3<= 2.2.22.2.30
7 May 2025WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery4.3<= 2.1.92.2.00
21 Jan 2025WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval4.3<= 2.1.62.1.70
16 Jan 2025WP Hotel Booking <= 2.1.5 - Missing Authorization5.3<= 2.1.52.1.60
31 Oct 2024WP Hotel Booking <= 2.2.9 - Authenticated (Contributor+) Local File Inclusion8.8<= 2.2.92.3.0496
1 Oct 2024WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload8.8<= 2.1.22.1.30
19 Jun 2024WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection10<= 2.1.02.1.12
28 Mar 2024WP Hotel Booking <= 2.0.9.2 - Missing Authorization5.3<= 2.0.9.22.0.9.30
3 Feb 2024WP Hotel Booking <= 2.0.9.2 - Improper Authorization on Multiple REST API Routes6.5<= 2.0.9.22.0.9.30
26 Oct 2023WP Hotel Booking <= 2.0.7 - Unauthenticated SQL Injection9.8<= 2.0.72.0.80
26 Oct 2023WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion4.3<= 2.0.82.0.90
20 Oct 2023WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion6.5<= 2.0.72.0.80
22 Aug 2022WP Hotel Booking <= 2.0.0 - Missing Authorization to Settings Update7.5<= 2.0.02.0.147

Source: Wordfence Intelligence.

Reputation

Lifetime rating 3.7 from 67 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star42
4 star2
3 star2
2 star0
1 star21

Momentum

7,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Hotel Booking
4 May 2026244
11 May 2026523
18 May 2026459
25 May 20262,356
1 Jun 2026585
8 Jun 2026553
15 Jun 2026879
22 Jun 20262,458
29 Jun 2026625
6 Jul 20261,119
13 Jul 20262,580
20 Jul 20262,435
27 Jul 20261,065
3 Aug 2026880
10 Aug 2026429
17 Aug 2026487
24 Aug 2026475
31 Aug 2026450
7 Sep 2026413
14 Sep 2026404
21 Sep 2026477
28 Sep 2026463
5 Oct 2026484
12 Oct 2026567
19 Oct 2026568
26 Oct 2026595
2 Nov 20261,285

Weekly downloads over the last 4 weeks are 15% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

SimplyBook.me - Booking and reservations calendarScore 91 · 30,000+MotoPress Hotel Booking for ElementorScore 91 · 10,000+MotoPress Hotel Booking Styles & TemplatesScore 91 · 10,000+SetmoreScore 91 · 4,000+Zenchef widget integrationScore 91 · 2,000+

Facts

Version2.3.5
AuthorThimPress
Added28 Feb 2016
Last updated2 Nov 2026
Active installs7,000+
Requires WordPress6.4
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagsreservation, accommodation, Hotel Booking, booking system, room management

Other plugins by this author: LearnPress - WordPress LMS Plugin for Create and Sell Online Courses, WP Events Manager, LearnPress - Course Review, Thim Kit for Elementor - Pre-built Templates & Widgets for Elementor, LearnPress - Course Wishlist, LearnPress - Backup & Migration Tool, LearnPress - Prerequisites Courses, LearnPress - bbPress Integration, LearnPress - BuddyPress Integration, WP Hotel Booking WooCommerce, WP Events Manager WooCommerce, RealPress - Real Estate Plugin

Questions

Is WP Hotel Booking still maintained?

WP Hotel Booking was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is WP Hotel Booking safe?

WP Hotel Booking has no open unpatched vulnerabilities on record. 16 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WP Hotel Booking?

The wordpress.org author is ThimPress. Recent committers: ThimPress, phamtungpth, leehld, plugin-master. We have recorded no ownership change.

What can I use instead of WP Hotel Booking?

Plugins in the same category with a higher Canary Score: SimplyBook.me - Booking and reservations calendar, MotoPress Hotel Booking for Elementor, MotoPress Hotel Booking Styles & Templates, Setmore, Zenchef widget integration.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue