CVE-2026-15948
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.
Risk Assessment
The risk includes session hijacking, data theft, or malware distribution. Since the host role can be self-assigned by any visitor, the attack is effectively possible for unauthenticated users.
Recommendation
Update the plugin to a patched version and review the registration configuration to prevent self-assignment of host privileges. Also, regularly scan pages for malicious scripts.
Other vulnerabilities in Hydra Booking
See all- CVE-2026-92425Medium
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations. This allows users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
- CVE-2026-92421Medium
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request. This allows authenticated users holding a Hydra Booking-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
- CVE-2026-92420Low
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints. This allows a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.
- CVE-2026-28188High
Hydra Booking plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without authentication can exploit this flaw to perform unauthorized operations.
- CVE-2026-57388High
The Hydra Booking WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. This affects all versions up to and including 1.1.44.
- CVE-2026-42675High
Missing Authorization vulnerability in Themefic Hydra Booking up to version 1.1.41. It allows exploiting incorrectly configured access control security levels.
- CVE-2026-39541Medium
The Hydra Booking plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2025-49377Medium
The Hydra Booking plugin for Themefic has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.1.9.
Original NVD description (English source)
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS