CyberRota Analysis
AI-GeneratedThe Hydra Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the 'first_name' parameter due to inadequate input sanitization and output escaping, affecting all versions up to 1.2.2. This flaw allows authenticated attackers, including unauthenticated users who can self-assign the tfhb_host role through the public Signup shortcode, to inject malicious scripts that execute when other users access the compromised pages. WordPress site administrators using this plugin should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.