Hydra Booking CVE-2026-39541

This vulnerability presents a low real-world risk despite a moderate CVSS score of 5.9. The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) indicates attack requires high privilege level (administrator or equivalent), user interaction on the victim side, and low impact scope. The EPSS score of 0.03% (8th percentile) strongly suggests minimal likelihood of exploitation in the wild. The vulnerability requires two significant preconditions: the attacker must already possess high-privilege WordPress account access, and a victim user must interact with the malicious payload. This significantly reduces practical exploitability compared to unauthenticated remote code execution vulnerabilities. No KEV (CISA Known Exploited Vulnerabilities) status or public exploit code has been identified, further indicating low active threat.

An attacker with WordPress administrator privileges injects a malicious JavaScript payload into a booking form field (e.g., customer name or booking details) that is stored in the database. When another user (such as a booking manager or customer viewing their booking) accesses the page displaying this booking information, the stored XSS payload executes in their browser. The attacker can then steal session cookies, extract sensitive booking data, or redirect the user to a phishing site. This scenario requires the attacker to already have high-level plugin or site access, making it primarily a privilege-escalation or insider threat concern rather than a remote exploitation vector.