Is CVE-2026-15948 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15948 being exploited in the wild.

How severe is CVE-2026-15948?

Medium severity, with a CVSS score of 6.4, published 15 August 2026.

Which products and versions are affected?

Hydra Booking Hydra Booking up to and including 1.2.2.

Is there a fix for CVE-2026-15948?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15948 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15948?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15948: Hydra Booking stored cross-site scripting in first_name parameter

CVE-2026-15948 · Severity: medium · CVSS 6.4 · Published 2026-08-15

The Hydra Booking plugin for WordPress allows customers to schedule appointments through a public signup form. An attacker can inject malicious JavaScript code through the first name field during registration, which then runs whenever anyone views the booking details. Because the plugin lets new users self-assign a host role via the signup shortcode, this vulnerability is effectively exploitable by anyone without requiring prior authentication.

Quick answers

Is CVE-2026-15948 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15948 being exploited in the wild.
How severe is CVE-2026-15948?: Medium severity, with a CVSS score of 6.4, published 15 August 2026.
Which products and versions are affected?: Hydra Booking Hydra Booking up to and including 1.2.2.
Is there a fix for CVE-2026-15948?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15948 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15948?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Hydra Booking WordPress plugin affecting versions up to 1.2.2. The vulnerability exists in the 'first_name' parameter due to insufficient input sanitization and output escaping in the HostsController. An attacker can register via the plugin's public Signup shortcode, self-assign the tfhb_host role, and inject arbitrary JavaScript that persists in the database. The malicious script executes whenever an authorized user accesses a page containing the injected data. While the vulnerability requires the attacker to complete the registration flow, the ability to self-assign the required role makes it exploitable by any unauthenticated visitor.

Affected products

Hydra Booking Hydra Booking up to and including 1.2.2

Timeline

2026-08-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.