Plugin icon

Hydra Booking — Appointment Scheduling & Booking Calendar

hydra-booking

Vulnerabilities:

17

Last Updated:

September 16, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-09-17
Title
Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
Fixed in
Fixed in 1.2.4
CVSS
5.5 (medium)
Published
2026-09-17
Title
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
Fixed in
Fixed in 1.2.2
CVSS
3.8 (low)
Published
2026-09-17
Title
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
Fixed in
Fixed in 1.2.3
CVSS
4.7 (medium)
Published
2026-08-14
Title
Hydra Booking < 1.2.3 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
Fixed in
Fixed in 1.2.3
CVSS
6.4 (medium)
Published
2026-08-13
Title
Hydra Booking < 1.2.3 - Missing Authorization
Fixed in
Fixed in 1.2.3
CVSS
5.3 (medium)
Published
2026-07-08
Title
Hydra Booking < 1.2.2 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
Fixed in
Fixed in 1.2.2
CVSS
4.3 (medium)
Published
2026-07-08
Title
Hydra Booking — Appointment Scheduling & Booking Calendar < 1.1.45 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.45
CVSS
7.2 (high)
Published
2026-05-15
Title
Hydra Booking — Appointment Scheduling & Booking Calendar < 1.1.42 - Missing Authorization
Fixed in
Fixed in 1.1.42
CVSS
5.3 (medium)
Published
2026-02-15
Title
Hydra Booking < 1.1.39 - Authenticated (Hydra host+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.39
CVSS
6.4 (medium)
Published
2026-01-21
Title
Hydra Booking < 1.1.33 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 1.1.33
CVSS
9.8 (critical)
Published
2025-11-27
Title
Hydra Booking < 1.1.33 - Authenticated (Custom role+) SQL Injection
Fixed in
Fixed in 1.1.33
CVSS
6.5 (medium)
Published
2025-11-10
Title
Hydra Booking < 1.1.28 - Unauthenticated Payment Bypass
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-11-10
Title
Hydra Booking < 1.1.28 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-07-28
Title
Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
Fixed in
Fixed in 1.1.19
CVSS
8.8 (high)
Published
2025-06-12
Title
Hydra Booking < 1.1.11 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.1.11
CVSS
6.5 (medium)
Published
2025-06-12
Title
Hydra Booking < 1.1.10 - Missing Authorization
Fixed in
Fixed in 1.1.10
CVSS
4.3 (medium)
Published
2025-06-05
Title
Hydra Booking < 1.1.11 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 1.1.11
CVSS
6.5 (medium)