WP Hotel Booking

76 Quality Score

Active Installs

17/30

With 7,000 active installs, it is a niche product that has carved out a modest audience but sits well below mainstream booking tools.

Update Freshness

25/25

Updated within days of this assessment and tested against current WordPress, the maintenance signal is excellent.

User Rating

11/15

A 74 out of 100 from 67 ratings is middling: most users are satisfied, but feedback is not strong enough to call it a crowd favourite.

Support Health

8/15

Only 1 of 4 support threads is resolved, which is a real warning sign if you need help during setup or with edge cases.

WP Compatibility

15/15

Compatible with WordPress 6.4 through 7.0 and PHP 7.4, it covers the mainstream versions most sites run today.

Scores higher than 46% of indexed plugins

About

WordPress Hotel Booking Plugin - A complete hotel booking reservation plugin for WordPress.

Active Installs 7k+

Rating ★★★½ 3.7/5

Last Updated 2026-08-22 6:53am GMT

Requires WordPress 6.4+

Tested Up To 7.1

Requires PHP 7.4+

Security History

28 known vulnerabilities, all patched

3 Critical 4 High 21 Medium

Most recent: July 30, 2026

View details ▸

WP Hotel Booking < 2.3.2 - Authenticated (Custom role+) SQL Injection Medium

July 30, 2026 Patched in ["2.3.2"] CVE-2026-15153

WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute Medium

July 23, 2026 Patched in ["2.3.3"] CVE-2026-15464

Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation Medium

July 21, 2026 Patched in ["2.3.3"] CVE-2026-15149

WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter Medium

July 16, 2026 Patched in ["2.3.3"] CVE-2026-15094

WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler Medium

July 10, 2026 Patched in ["2.3.2"] CVE-2026-11901

WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters Medium

July 9, 2026 Patched in ["2.3.2"] CVE-2026-11392

Hotel Booking <= 2.3.1 - Unauthenticated Payment Bypass Medium

July 9, 2026 Patched in ["2.3.2"] CVE-2026-15152

WP Hotel Booking < 2.3.1 - Missing Authorization Medium

June 19, 2026 Patched in ["2.3.1"] CVE-2026-9822

WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter Medium

January 16, 2026 Patched in ["2.2.8"] CVE-2025-14075

Hotel Booking <= 2.2.8 - Cross-Site Request Forgery Medium

November 5, 2025 Patched in ["2.2.9"] CVE-2025-63012

Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure Medium

November 5, 2025 Patched in ["2.2.8"] CVE-2025-63013

Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting Medium

November 5, 2025 Patched in ["2.2.9"] CVE-2025-63011

WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation Medium

August 28, 2025 Patched in ["2.2.3"] CVE-2025-8942

WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery Medium

May 7, 2025 Patched in ["2.2.0"] CVE-2025-47448

WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval Medium

January 21, 2025 Patched in ["2.1.7"] CVE-2024-13447

WP Hotel Booking <= 2.1.5 - Missing Authorization Medium

January 16, 2025 Patched in ["2.1.6"] CVE-2024-12370

WP Hotel Booking <= 2.2.9 - Authenticated (Contributor+) Local File Inclusion High

October 31, 2024 Patched in ["2.3.0"] CVE-2024-51582

WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload High

October 1, 2024 Patched in ["2.1.3"] CVE-2024-7855

WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection Critical

June 19, 2024 Patched in ["2.1.1"] CVE-2024-3605

WP Hotel Booking <= 2.0.9.2 - Missing Authorization Medium

March 28, 2024 Patched in ["2.0.9.3"] CVE-2024-30508

WP Hotel Booking <= 2.0.9.2 - Improper Authorization on Multiple REST API Routes Medium

February 3, 2024 Patched in ["2.0.9.3"]

WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion Medium

October 26, 2023 Patched in ["2.0.9"] CVE-2023-5799

WP Hotel Booking <= 2.0.7 - Unauthenticated SQL Injection Critical

October 26, 2023 Patched in ["2.0.8"] CVE-2023-5652

WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion Medium

October 20, 2023 Patched in ["2.0.8"] CVE-2023-5651

WP Hotel Booking <= 2.0.0 - Missing Authorization to Settings Update High

August 22, 2022 Patched in ["2.0.1"]

WP Hotel Booking <= 1.10.5 - Cross-Site Request Forgery High

August 2, 2022 Patched in ["1.10.6"] CVE-2021-36852

WP Hotel Booking <= 1.10.3 - Remote Code Execution Critical

December 8, 2020 Patched in ["1.10.4"] CVE-2020-29047

WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass Medium

September 16, 2020 Patched in ["1.10.2"] CVE-2020-36757

What It Does

WP Hotel Booking turns a WordPress site into a property reservation system, letting owners list rooms or accommodations, manage availability, and accept online bookings. It includes room management, pricing rules, and a checkout flow for guests.

Who It's For

It is best for small to mid-sized lodging businesses running on WordPress, such as boutique hotels, B&Bs, guesthouses, and small vacation rental managers who want a self-hosted booking engine without paying monthly SaaS fees.

Who Should Skip It

Large resorts, OTAs, or anyone needing a channel manager, integrated payment reconciliation, or property management depth should look elsewhere, since this plugin lacks those enterprise features.

The Bottom Line

WP Hotel Booking delivers the core hotel reservation workflow at a fair quality score of 75.82 out of 100, with strong maintenance but weak support engagement. It is a reasonable choice for small properties, yet anyone needing reliable support or large-scale features should consider Amelia or WP Booking System.

Pick this if you are booking time slots for services or consultations rather than overnight rooms.

Booking for Appointments and Events Calendar - Amelia 83/100

Pick Amelia if you want a more polished interface, stronger support, and modern appointment workflows.

Online Scheduling and Appointment Booking System - Bookly 82/100

Pick Bookly if you need a feature-rich appointment system with a proven track record and larger install base.

WP Booking System - Booking Calendar 81/100

Pick WP Booking System for a flexible, calendar-driven booking plugin that adapts to many rental scenarios.

FluentBooking - The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution 81/100

Pick FluentBooking if you already use FluentCRM or want a modern, lightweight scheduling tool.