What is the CVSS score of CVE-2026-15948?

CVE-2026-15948 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Hydra Booking CVE-2026-15948

EUVD-2026-58861 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-15 Wordfence

GHSA-423j-8hf8-fp25

WordPress XSS Wordpress Plugin Hydra Booking Appointment Scheduling Booking Calendar Themefic

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects the required tfhb_host role; UI:R because a victim must visit the archive page for execution; S:C for cross-boundary browser context impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 04:05 vuln.today

CVE Published

Aug 15, 2026 - 03:25 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Hydra Booking - Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.

AnalysisAI

Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized first_name parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a tfhb_host, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.

Technical ContextAI

The vulnerability resides in the Themefic Hydra Booking plugin (CPE: cpe:2.3:a:themefic:hydra_booking_-_appointment_scheduling_&_booking_calendar:*:*:*:*:*:*:*:*) and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is a dual failure: the first_name parameter accepted by HostsController.php (lines 77 and 495) is stored without sanitization, and the archive page template (archive-page-tfhb-host.php, line 30) renders it without output escaping. This classic CWE-79 pattern - absent both input sanitization and output encoding - means attacker-supplied script tags survive the full round-trip from form submission to page rendering. The CVSS scope change (S:C) reflects execution occurring in the victim's browser context, outside the WordPress server's security boundary.

RemediationAI

Update the Hydra Booking plugin to the latest version available in the WordPress plugin repository, which incorporates the fix committed in SVN changeset 3632543 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3632543%40hydra-booking&new=3632543%40hydra-booking); a specific released version number is not confirmed in available data, so verify the installed version exceeds 1.2.2 after updating. As an immediate compensating control where patching is not yet possible, remove the public Signup shortcode from all frontend pages to prevent unauthenticated visitors from self-assigning the tfhb_host role - this eliminates the primary low-barrier escalation path but does not remove the underlying XSS flaw for legitimately provisioned host accounts. Additionally, audit existing host registrations for unexpected accounts that may have been created by prior exploitation, and inspect host profile first_name values for injected script content. Full advisory detail is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/8331fe3f-e943-4f4c-887f-761f3e18eb79?source=cve.