# CVE-2026-39541: Themefic Hydra Booking Stored XSS

Source: https://junglewise.ai/threats/cve-2026-39541-themefic-hydra-booking-stored-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39541 · Severity: medium · CVSS 5.9 · Published 2026-04-08

Themefic Hydra Booking, a WordPress plugin used for managing reservations and bookings, contains a security flaw that allows for stored cross-site scripting. An attacker with high-level administrative privileges can inject malicious scripts into the website's pages. If a site visitor or another administrator views the affected page, these scripts could be used to redirect users to malicious sites, display unauthorized advertisements, or steal session information.

Technologies: [Themefic Hydra Booking](https://junglewise.ai/threats/technologies/hydra-booking). Vendors: [Themefic](https://junglewise.ai/threats/vendors/themefic).

## Quick answers

**Is CVE-2026-39541 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39541 being exploited in the wild.

**How severe is CVE-2026-39541?** Medium severity, with a CVSS score of 5.9, published 8 April 2026.

**Which products and versions are affected?** Themefic Hydra Booking <= 1.1.38.

**Is there a fix for CVE-2026-39541?** A patch was published on 2026-02-15: Patch released in version 1.1.39 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39541 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39541?** Check whether you run Themefic Hydra Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Themefic Hydra Booking plugin for WordPress (versions <= 1.1.38) due to improper neutralization of user-supplied input during web page generation. The vulnerability requires high-level privileges (Hydra Host role) to inject malicious payloads into the database. Successful exploitation occurs when a victim, such as a site administrator or guest, interacts with the affected page, causing the script to execute in their browser context. This can lead to unauthorized actions, data theft, or site defacement. The issue is resolved in version 1.1.39.

## Affected products

- Themefic Hydra Booking <= 1.1.38

## Timeline

- 2026-01-16: disclosed: Reported by benzdeus via Patchstack
- 2026-02-15: advisory: Initial advisory published by Patchstack
- 2026-04-08: advisory: NVD publication date
- 2026-02-15: patched: Patch released in version 1.1.39

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-38-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-38-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Themefic Hydra Booking Stored XSS](https://junglewise.ai/threats/cve-2026-57388-themefic-hydra-booking-stored-xss)
- [Themefic Hydra Booking IDOR in booking details endpoint](https://junglewise.ai/threats/cve-2026-12433-themefic-hydra-booking-idor-in-booking-details-endpoint)
- [Themefic Hydra Booking missing authorization in WordPress plugin](https://junglewise.ai/threats/cve-2026-42675-themefic-hydra-booking-missing-authorization-in-wordpress-plugin)