CVE Catalog
CVE-2026-39541
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
The Hydra Booking plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
Risk Assessment
Risk of session theft, defacement, or theft of sensitive data from users visiting the infected page.
Recommendation
Update the Hydra Booking plugin to version 1.1.39 or later.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.