CVE-2026-15464 is a stored cross-site scripting vulnerability in the WP Hotel Booking WordPress plugin, specifically in the 'widget_search' shortcode attribute. Due to insufficient input sanitization and output escaping, authenticated attackers with contributor or higher privileges can inject arbitrary web scripts. These scripts execute when users visit the injected pages, leveraging browsers that support access keys since the payload is stored in a hidden attribute. The vulnerability affects all versions up to and including 2.3.2. No official patch or remediation level has been published yet.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. This can lead to execution of arbitrary scripts in the context of users visiting those pages, potentially compromising user data confidentiality and integrity. The impact is limited to browsers supporting access keys due to the payload storage method. There is no indication of denial of service or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'widget_search' shortcode. Monitor vendor channels for updates and apply patches promptly once released.