Description

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-15T04:18:08.773Z",
  "pubdate": "2026-08-15T04:18:08.773Z",
  "executiveSummary": "The Hydra Booking - Appointment Scheduling & Booking Calendar plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw exists due to inadequate input sanitization and output escaping mechanisms applied to the 'first_name' parameter.\nThe vulnerability allows authenticated actors with host-level privileges and above to inject arbitrary web scripts or HTML into administrative or frontend pages. Whenever a user navigates to the affected page, the malicious payload executes within the context of their browser session.\nAlthough the vulnerability nominally requires the 'tfhb_host' role, the attack vector is significantly amplified because this specific role can be arbitrarily self-assigned by any unauthenticated visitor utilizing the plugin's public Signup shortcode. Consequently, remote, unauthenticated attackers can successfully complete the registration workflow to obtain the necessary privileges and trigger the payload.\nSuccessful exploitation of this flaw can lead to severe security implications, including session hijacking, credential theft, unauthorized administrative actions, and further compromise of the underlying WordPress installation.",
  "technicalDetails": "The vulnerability resides within the Hydra Booking - Appointment Scheduling & Booking Calendar plugin for WordPress, specifically affecting all versions up to and including 1.2.2.\nThe root cause of the Stored Cross-Site Scripting (XSS) vulnerability is the failure of the application to properly sanitize user-supplied input submitted via the 'first_name' parameter, coupled with a lack of secure output escaping when rendering this data back to the user interface.\nThe vulnerable component is the registration and profile management handling tied to the 'tfhb_host' role. Attackers leverage the public-facing Signup shortcode provided by the plugin to register a new account. During this public registration flow, the application insufficiently validates or restricts role assignment, enabling the registering user to automatically assign themselves the 'tfhb_host' role.\nOnce the attacker possesses the 'tfhb_host' role, they gain the requisite privileges to interact with the vulnerable 'first_name' parameter. By supplying a maliciously crafted payload containing JavaScript (e.g., event handlers or script tags) in the 'first_name' input field, the payload is persistently stored in the database.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker visits the public registration page containing the plugin's shortcode. 2) The attacker completes the registration flow, leveraging the insecure role assignment mechanism to acquire the 'tfhb_host' role. 3) The attacker submits a malicious JavaScript payload through the 'first_name' parameter. 4) The server accepts and stores the unsanitized payload within the database. 5) When an administrative user or victim accesses the injected page where the stored first name is rendered, the web browser executes the arbitrary script.\nBecause the execution occurs within the victim's browser session, the payload inherits their privileges, potentially facilitating privilege escalation, unauthorized modifications, or complete account takeover depending on the victim's access level."
}