PatchTheCVE: js multi hotelhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2014-100009: The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress alhttps://patchthecve.com/cve/CVE-2014-100009.htmlhttps://patchthecve.com/cve/CVE-2014-100009.htmlWed, 17 Jun 2026 00:04:00 +0000MEDIUM 5.0: The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to (1) functions.php, (2) myCalendar.php, (3) refreshDate.php, (4) show_image.php, (5) widget.php, (6) phpthumb/GdThumb.inCVE-2014-100008: Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS Mhttps://patchthecve.com/cve/CVE-2014-100008.htmlhttps://patchthecve.com/cve/CVE-2014-100008.htmlWed, 17 Jun 2026 00:04:00 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.CVE-2013-7419: Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS https://patchthecve.com/cve/CVE-2013-7419.htmlhttps://patchthecve.com/cve/CVE-2013-7419.htmlWed, 17 Jun 2026 00:01:55 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter.