CVE-2026-15948

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.3

Description Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web scripts into pages that execute when accessed by other users. While the exploit requires the tfhb host role, this role can be self-assigned by any visitor using the public Signup shortcode, enabling unauthenticated users who complete registration to perform the attack via the first name parameter.

Recommendations Update Hydra Booking — Appointment Scheduling & Booking Calendar to a version newer than 1.2.2. Restrict the use of the public Signup shortcode to prevent unauthorized users from assigning themselves the tfhb host role.