WordPress plugin
Hydra Booking — Appointment Scheduling & Booking Calendar security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High2
- Medium14
- Low0
All Hydra Booking — Appointment Scheduling & Booking Calendar vulnerabilities
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
≤1.2.2Update to 1.2.3
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
≤1.2.1Update to 1.2.2
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
≤1.2.3Update to 1.2.4
- Medium6.4Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
≤1.2.2Update to 1.2.3
- Medium5.3Missing Authorization
≤1.2.2Update to 1.2.3
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
≤1.2.1Update to 1.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.1.44Update to 1.1.45
- Medium5.3Missing Authorization
≤1.1.41Update to 1.1.42
- Medium6.4Authenticated (Hydra host+) Stored Cross-Site Scripting
≤1.1.38Update to 1.1.39
- Critical9.8Unauthenticated Privilege Escalation
≤1.1.32Update to 1.1.33
- Medium6.5Authenticated (Custom role+) SQL Injection
≤1.1.32Update to 1.1.33
- Medium5.3Missing Payment Verification to Unauthenticated Payment Bypass
≤1.1.27Update to 1.1.28
- Medium5.3Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
≤1.1.27Update to 1.1.28
- High8.81.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
1.1.0 – 1.1.18Update to 1.1.19
- Medium4.3Missing Authorization
≤1.1.9Update to 1.1.10
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.1.10Update to 1.1.11
- Medium6.5Authenticated (Contributor+) SQL Injection
≤1.1.10Update to 1.1.11
Hydra Booking — Appointment Scheduling & Booking Calendar: common questions
Does Hydra Booking — Appointment Scheduling & Booking Calendar have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in Hydra Booking — Appointment Scheduling & Booking Calendar: 1 critical, 2 high, 14 medium. None are known to affect version null.
How do I check which version of Hydra Booking — Appointment Scheduling & Booking Calendar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Hydra Booking — Appointment Scheduling & Booking Calendar vulnerability?
CVE-2026-92421, published Sep 17, 2026: Hydra Booking <= 1.2.2 - Authenticated (Hydra Host+) Insecure Direct Object Reference. Severity: Medium (CVSS 4.3).
Is any Hydra Booking — Appointment Scheduling & Booking Calendar vulnerability listed in CISA KEV?
No. None of the known Hydra Booking — Appointment Scheduling & Booking Calendar vulnerabilities is currently listed in the CISA KEV catalog.