What is the CVSS score of CVE-2026-57388?

CVE-2026-57388 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Hydra Booking are affected by CVE-2026-57388?

Themefic's Hydra Booking WordPress plugin (versions through 1.1.44) contains a stored cross-site scripting vulnerability that persists in the browser of anyone viewing affected pages, including…

How to fix or mitigate CVE-2026-57388?

Within 24 hours, identify all WordPress installations running Themefic Hydra Booking plugin version 1.1.44 or earlier and review admin access logs and session activity for signs of exploitation. Within 7 days, immediately disable or uninstall the plugin from all affected systems; if operationally critical, implement a Web Application Firewall rule to block XSS payloads in booking form inputs and restrict administrative dashboard access to specific IP addresses. Within 30 days, transition to an alternative booking solution or maintain close monitoring of the Patchstack advisory and plugin repository for a vendor-released patch; apply any available patch immediately upon release.

Hydra Booking CVE-2026-57388

EUVD-2026-43461 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Hydra Booking Wordpress Plugin Themefic

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable stored XSS storable without privileges via a public booking form, but requiring an admin to view the payload (UI:R), with script executing in the victim's context (S:C) for limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:02 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.44.

AnalysisAI

Stored cross-site scripting in Themefic's Hydra Booking WordPress plugin (all versions up to and including 1.1.44) lets an attacker inject persistent JavaScript that executes in the browser of a victim who later views the affected page. The Patchstack-reported flaw (CVSS 7.1, scope-changed) requires victim interaction to fire, and no public exploit has been identified at time of analysis. Because impact crosses the security boundary into a privileged WordPress admin session, it can facilitate session hijacking or actions in the admin's context.

Technical ContextAI

Hydra Booking is an appointment/booking-management plugin for WordPress developed by Themefic, integrating booking forms, calendars, and meeting scheduling into WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-controllable input is stored server-side and later rendered into an HTML page without adequate output encoding or sanitization, so embedded markup/script is interpreted by the browser rather than displayed as text. In a WordPress plugin context the unsanitized booking/form fields are the injection sink, and the payload is persisted (stored XSS) and executed when a page is rendered - most impactfully in the wp-admin dashboard where a submitted booking is reviewed. The single CPE, cpe:2.3:a:themefic:hydra_booking:*:*:*:*:*:*:*:*, confirms all versions through 1.1.44 are in scope.

RemediationAI

No vendor-released patch version is identified in the provided data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-44-cross-site-scripting-xss-vulnerability?_s_id=cve) and upgrade to the first release published after 1.1.44 as soon as it is available. As compensating controls until a fixed version is confirmed: place the site behind a WAF with XSS/virtual-patching rules (Patchstack offers this) to filter malicious markup in booking submissions; restrict or gate public access to the booking submission endpoints so untrusted input cannot be freely stored; and have staff review incoming bookings from a hardened, non-persistent-login context. Trade-offs: WAF rules can produce false positives on legitimate rich input, and gating public forms may reduce the plugin's core self-service function. Deactivating the plugin entirely eliminates the exposure but removes booking functionality.