WP Hotel Booking

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 41% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. A declining trend compresses what a buyer would pay.

1. ★★★★★ jmacwell

   3mo ago

   Great program and the support was timely and effective. Love it.

   Read on wp.org ↗
2. ★★★★★ Dunos

   7mo ago

   Great hotel booking plugin with solid features. I love this team and hope they keep updating it in the future.

   Read on wp.org ↗
3. ★★★★★ MhrTheme

   1.3y ago

   I got the best support from the plugin team.

   Read on wp.org ↗
4. ★★★★★ niki1973

   1.6y ago

   Minimum night reservation in settings it doesn’t work

   Read on wp.org ↗
5. ★★★★★ balken

   1.9y ago

   You need loads of plugins to make this one “work” – booking is a mess, useless design on that too DONT DO IT

   Read on wp.org ↗
6. ★★★★★ vinciego

   2.2y ago

   I use official template from WordPress… And the plugin is not even compatible with that

   Read on wp.org ↗
7. ★★★★★ martegraphics

   2.5y ago

   I don’t recommend. it worked for a few days then only bugs

   Read on wp.org ↗
8. ★★★★★ jarvindesign

   2.6y ago

   The plugin is full of bugs This topic was modified 2 years, 5 months ago by jarvindesign.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-07-20 Version 2.3.4 ~ Fixed: security from Levi report. 2.3.4
2. 2026-07-16 Version 2.3.3 ~ Fixed: security. 2.3.3
3. 2026-06-23 Version 2.3.2 ~ Fixed: security. ~ Fixed: minor bugs. 2.3.2
4. 2026-05-25 Version 2.3.1 ~ Fixed: security. 2.3.1
5. 2026-03-11 Version 2.3.0 ~ Fixed: security. 2.3.0
6. 2026-02-06 Version 2.2.9 ~ Fixed: security. ~ Update: layout checkout page. 2.2.9

28 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.5 WP Hotel Booking < 2.3.2 - Authenticated (Custom role+) SQL Injection ↗
   2026-07-30 CVE-2026-15153 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 2.3.2 Patched in 2.3.2
2. Medium · 6.4 WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute ↗
   2026-07-23 CVE-2026-15464 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.2 Patched in 2.3.3
3. Medium · 5.3 Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation ↗
   2026-07-21 CVE-2026-15149 Client-Side Enforcement of Server-Side Security Affects <= 2.3.2 Patched in 2.3.3
4. Medium · 6.1 WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter ↗
   2026-07-16 CVE-2026-15094 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.2 Patched in 2.3.3
5. Medium · 5.3 WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler ↗
   2026-07-10 CVE-2026-11901 Insufficient Verification of Data Authenticity Affects <= 2.3.1 Patched in 2.3.2
6. Medium · 6.1 WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters ↗
   2026-07-09 CVE-2026-11392 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.1 Patched in 2.3.2
7. Medium · 5.3 Hotel Booking <= 2.3.1 - Unauthenticated Payment Bypass ↗
   2026-07-09 CVE-2026-15152 Insufficient Verification of Data Authenticity Affects <= 2.3.1 Patched in 2.3.2
8. Medium · 4.3 WP Hotel Booking < 2.3.1 - Missing Authorization ↗
   2026-06-19 CVE-2026-9822 Missing Authorization Affects < 2.3.1 Patched in 2.3.1
9. Medium · 5.3 WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter ↗
   2026-01-16 CVE-2025-14075 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.2.7 Patched in 2.2.8
10. Medium · 4.3 Hotel Booking <= 2.2.8 - Cross-Site Request Forgery ↗
    2025-11-05 CVE-2025-63012 Cross-Site Request Forgery (CSRF) Affects <= 2.2.8 Patched in 2.2.9
11. Medium · 5.3 Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure ↗
    2025-11-05 CVE-2025-63013 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.2.7 Patched in 2.2.8
12. Medium · 4.4 Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
    2025-11-05 CVE-2025-63011 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.8 Patched in 2.2.9
13. Medium · 4.3 WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation ↗
    2025-08-28 CVE-2025-8942 Missing Authorization Affects <= 2.2.2 Patched in 2.2.3
14. Medium · 4.3 WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery ↗
    2025-05-07 CVE-2025-47448 Cross-Site Request Forgery (CSRF) Affects <= 2.1.9 Patched in 2.2.0
15. Medium · 4.3 WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval ↗
    2025-01-21 CVE-2024-13447 Missing Authorization Affects <= 2.1.6 Patched in 2.1.7
16. Medium · 5.3 WP Hotel Booking <= 2.1.5 - Missing Authorization ↗
    2025-01-16 CVE-2024-12370 Improper Access Control Affects <= 2.1.5 Patched in 2.1.6
17. High · 8.8 WP Hotel Booking <= 2.2.9 - Authenticated (Contributor+) Local File Inclusion ↗
    2024-10-31 CVE-2024-51582 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 2.2.9 Patched in 2.3.0
18. High · 8.8 WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload ↗
    2024-10-01 CVE-2024-7855 Unrestricted Upload of File with Dangerous Type Affects <= 2.1.2 Patched in 2.1.3
19. Critical · 10.0 WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection ↗
    2024-06-19 CVE-2024-3605 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.1.0 Patched in 2.1.1
20. Medium · 5.3 WP Hotel Booking <= 2.0.9.2 - Missing Authorization ↗
    2024-03-28 CVE-2024-30508 Missing Authorization Affects <= 2.0.9.2 Patched in 2.0.9.3
21. Medium · 6.5 WP Hotel Booking <= 2.0.9.2 - Improper Authorization on Multiple REST API Routes ↗
    2024-02-03 Improper Authorization Affects <= 2.0.9.2 Patched in 2.0.9.3
22. Medium · 4.3 WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion ↗
    2023-10-26 CVE-2023-5799 Incorrect Authorization Affects <= 2.0.8 Patched in 2.0.9
23. Critical · 9.8 WP Hotel Booking <= 2.0.7 - Unauthenticated SQL Injection ↗
    2023-10-26 CVE-2023-5652 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.0.7 Patched in 2.0.8
24. Medium · 6.5 WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion ↗
    2023-10-20 CVE-2023-5651 Missing Authorization Affects <= 2.0.7 Patched in 2.0.8
25. High · 7.5 WP Hotel Booking <= 2.0.0 - Missing Authorization to Settings Update ↗
    2022-08-22 Missing Authorization Affects <= 2.0.0 Patched in 2.0.1
26. High · 8.8 WP Hotel Booking <= 1.10.5 - Cross-Site Request Forgery ↗
    2022-08-02 CVE-2021-36852 Cross-Site Request Forgery (CSRF) Affects <= 1.10.5 Patched in 1.10.6
27. Critical · 9.8 WP Hotel Booking <= 1.10.3 - Remote Code Execution ↗
    2020-12-08 CVE-2020-29047 Deserialization of Untrusted Data Affects <= 1.10.3 Patched in 1.10.4
28. Medium · 4.3 WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass ↗
    2020-09-16 CVE-2020-36757 Cross-Site Request Forgery (CSRF) Affects < 1.10.2 Patched in 1.10.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 13 languages, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-19 8K+ → 7K+ down after 666 days in tier
2. 2024-08-22 9K+ → 8K+ down after 480 days in tier
3. 2023-04-30 10K+ → 9K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Hotel Booking for WooCommerce 100+ installs · 4.1★ · 3 shared tags B
• MotoPress Hotel Booking 10K+ installs · 3.7★ · 2 shared tags B
• MotoPress Hotel Booking for Elementor 10K+ installs · 3.9★ · 2 shared tags B
• Checkfront Online Booking System 2K+ installs · 4.0★ · 2 shared tags D
• MotoPress Hotel Booking for Divi 1K+ installs · 3.5★ · 2 shared tags B
• WP Hotel Booking WooCommerce 1K+ installs · 3.8★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for WP Hotel Booking into a readme, a review or a deck. It updates itself.

WP Hotel Booking: 7K+ active installs, 3.7★ (67 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wp-hotel-booking