Plugin icon

Hydra Booking — Appointment Scheduling & Booking Calendar

hydra-booking

Vulnerabilities:

10

Last Updated:

May 19, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-05-15
Title
Hydra Booking — Appointment Scheduling & Booking Calendar < 1.1.42 - Missing Authorization
Fixed in
Fixed in 1.1.42
CVSS
5.3 (medium)
Published
2026-02-15
Title
Hydra Booking < 1.1.39 - Authenticated (Hydra host+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.39
CVSS
6.4 (medium)
Published
2026-01-21
Title
Hydra Booking < 1.1.33 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 1.1.33
CVSS
9.8 (critical)
Published
2025-11-27
Title
Hydra Booking < 1.1.33 - Authenticated (Custom role+) SQL Injection
Fixed in
Fixed in 1.1.33
CVSS
6.5 (medium)
Published
2025-11-10
Title
Hydra Booking < 1.1.28 - Unauthenticated Payment Bypass
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-11-10
Title
Hydra Booking < 1.1.28 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
Fixed in
Fixed in 1.1.28
CVSS
5.3 (medium)
Published
2025-07-28
Title
Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
Fixed in
Fixed in 1.1.19
CVSS
8.8 (high)
Published
2025-06-12
Title
Hydra Booking < 1.1.11 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.1.11
CVSS
6.5 (medium)
Published
2025-06-12
Title
Hydra Booking < 1.1.10 - Missing Authorization
Fixed in
Fixed in 1.1.10
CVSS
4.3 (medium)
Published
2025-06-05
Title
Hydra Booking < 1.1.11 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 1.1.11
CVSS
6.5 (medium)