CVE-2026-57388
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Hydra Booking WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. This affects all versions up to and including 1.1.44.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the browsers of administrators and users, potentially leading to session hijacking, account takeover, or website defacement.
Recommendation
Immediately update the Hydra Booking plugin to a version newer than 1.1.44 once a patch is released. Until then, restrict admin panel access and consider using a Web Application Firewall (WAF).
Other vulnerabilities in Hydra Booking
See all- CVE-2026-15948Medium
The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.
- CVE-2026-28188High
Hydra Booking plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without authentication can exploit this flaw to perform unauthorized operations.
- CVE-2026-42675High
Missing Authorization vulnerability in Themefic Hydra Booking up to version 1.1.41. It allows exploiting incorrectly configured access control security levels.
- CVE-2026-39541Medium
The Hydra Booking plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.44.