Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · hydra-booking
Hydra Booking
17 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not perform object-level authorisation checks on several of its host-management operationsCVE-2026-92425 · fixed in 1.2.4 · reported by WPScanMedium 5.5
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not verify that the host record being modified belongs to the user making the requestCVE-2026-92421 · fixed in 1.2.3 · reported by WPScanMedium 4.7
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpointsCVE-2026-92420 · fixed in 1.2.2 · reported by WPScanLow 3.8
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.
Aug 15, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Stored Cross-Site ScriptingCVE-2026-15948 · affects up to 1.2.2 · reported by WordfenceMedium 6.4
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.CVE-2026-28188 · affects up to 1.2.2 · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
Jul 13, 2026Hydra Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57388 · affects up to 1.1.44 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.44.
Jul 9, 2026Hydra Booking – Appointment Scheduling & Booking Calendar: Insecure Direct Object ReferenceCVE-2026-12433 · affects up to 1.2.1 · reported by WordfenceMedium 4.3
The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. This is due to the getBookingDetails() callback only enforcing the tfhb_manage_options capability via tfhb_manage_options_permission(), without verifying that the requested booking belongs to the currently authenticated host (the lookup in getBookingDetailsData() filters solely on the booking id supplied in the URL). This makes it possible for authenticated attackers, with Hydra Host-level access and above (a role created by the plugin which grants tfhb_manage_options), to view sensitive booking records belonging to other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes by iterating booking IDs.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 1, 2026Hydra Booking: Missing AuthorizationCVE-2026-42675 · affects up to 1.1.41 · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41.
Apr 8, 2026Hydra Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39541 · affects up to 1.1.38 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.
Jan 22, 2026Hydra Booking: Incorrect Privilege AssignmentCVE-2025-68027 · affects up to 1.1.32 · reported by PatchstackHigh 7.3
Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32.
Dec 16, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68055 · affects up to 1.1.32 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Missing payment verification to unauthenticated payment bypassCVE-2025-12788 · affects up to 1.1.27 · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Unauthorized booking cancellationCVE-2025-12787 · affects up to 1.1.27 · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhb_meeting_form_submit_callback" function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.
Oct 22, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49378 · affects up to 1.1.10 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.
Oct 22, 2025Hydra Booking: Missing AuthorizationCVE-2025-49377 · affects up to 1.1.9 · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.
Jul 29, 2025Hydra Booking: Privilege EscalationCVE-2025-7689 · affects 1.1.0 to 1.1.18 · reported by WordfenceHigh 8.8
The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.
Jun 6, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49323 · affects up to 1.1.10 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.