CVE-2026-11392 is a reflected cross-site scripting vulnerability in the WP Hotel Booking WordPress plugin by thimpress. The issue exists in versions up to 2.3.1 due to improper neutralization of input in the 'check_in_date' and 'check_out_date' parameters. Attackers can exploit this by tricking users into clicking malicious links that execute arbitrary scripts in the context of the affected site. The vulnerability is classified under CWE-79 and has a CVSS v3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the vulnerable website when a user clicks a crafted link. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no direct impact on system availability. The vulnerability affects all users who interact with the maliciously crafted input parameters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should consider disabling or restricting access to the affected parameters or plugin functionality if possible. Additionally, applying web application firewall (WAF) rules to detect and block malicious input targeting these parameters may reduce risk. Monitor vendor channels for updates and apply official patches once released.