WordPress security by component
Hydra Booking
Plugin description
Hydra Booking is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 8.8.
Plugin slug:
hydra-bookingLatest vulnerability
CVE-2026-57388: Hydra Booking: Cross-site scripting
Hydra Booking is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.1.44.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-57388
Hydra Booking: Cross-site scripting
Hydra Booking is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.1.44.
|
1.1.45 |
CVE7.1
NVDPending
|
| Jul 09, 2026 |
CVE-2026-12433
Hydra Booking — Appointment Scheduling & Booking Calendar: A security weakness
Hydra Booking — Appointment Scheduling & Booking Calendar is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.2.1.
|
> 1.2.1 |
CVE4.3
NVDPending
|
| Jun 01, 2026 |
CVE-2026-42675
Hydra Booking: A security weakness
Hydra Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 1.1.41.
|
1.1.42 |
CVE7.3
NVDPending
|
| Apr 08, 2026 |
CVE-2026-39541
Hydra Booking: Cross-site scripting
Hydra Booking is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.1.38.
|
1.1.39 |
CVE5.9
NVDPending
|
| Jan 22, 2026 |
CVE-2025-68027
Hydra Booking: Privilege escalation or authentication bypass
Hydra Booking is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE7.3
NVDPending
|
| Dec 16, 2025 |
CVE-2025-68055
Hydra Booking: SQL injection
Hydra Booking is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVDPending
|
| Oct 22, 2025 |
CVE-2025-49378
Hydra Booking: SQL injection
Hydra Booking is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVDPending
|
| Oct 22, 2025 |
CVE-2025-49377
Hydra Booking: A security weakness
Hydra Booking is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.3
NVDPending
|
| Jul 29, 2025 |
CVE-2025-7689
Hydra Booking: Privilege escalation or authentication bypass
Hydra Booking is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jun 06, 2025 |
CVE-2025-49323
Hydra Booking: SQL injection
Hydra Booking is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVDPending
|