AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-15948

MEDIUM · CVSS 6.4 Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-15 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The Hydra Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the 'first_name' parameter due to inadequate input sanitization and output escaping, affecting all versions up to 1.2.2. This flaw allows authenticated attackers, including unauthenticated users who can self-assign the tfhb_host role through the public Signup shortcode, to inject malicious scripts that execute when other users access the compromised pages. WordPress site administrators using this plugin should prioritize patching to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-15948
Severity
MEDIUM
CVSS
6.4
EPSS
N/A
WordPress

Original NVD Description

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.