CVE-2026-15948
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.
Risk Assessment
The risk includes session hijacking, data theft, or malware distribution. Since the host role can be self-assigned by any visitor, the attack is effectively possible for unauthenticated users.
Recommendation
Update the plugin to a patched version and review the registration configuration to prevent self-assignment of host privileges. Also, regularly scan pages for malicious scripts.
Original NVD description (English source)
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.