WordPress plugin
Hydra Booking — Appointment Scheduling & Booking Calendar security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High2
- Medium14
- Low0
All Hydra Booking — Appointment Scheduling & Booking Calendar vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.1.44Update to 1.1.45 | CVE-2026-57388 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤1.1.32Update to 1.1.33 | CVE-2025-68027 | |
| High8.8 | 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function 1.1.0 – 1.1.18Update to 1.1.19 | CVE-2025-7689 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.1.44Update to 1.1.45
- Critical9.8Unauthenticated Privilege Escalation
≤1.1.32Update to 1.1.33
- High8.81.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
1.1.0 – 1.1.18Update to 1.1.19
Hydra Booking — Appointment Scheduling & Booking Calendar: common questions
Does Hydra Booking — Appointment Scheduling & Booking Calendar have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in Hydra Booking — Appointment Scheduling & Booking Calendar: 1 critical, 2 high, 14 medium. None are known to affect version null.
How do I check which version of Hydra Booking — Appointment Scheduling & Booking Calendar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Hydra Booking — Appointment Scheduling & Booking Calendar vulnerability?
CVE-2026-92421, published Sep 17, 2026: Hydra Booking <= 1.2.2 - Authenticated (Hydra Host+) Insecure Direct Object Reference. Severity: Medium (CVSS 4.3).
Is any Hydra Booking — Appointment Scheduling & Booking Calendar vulnerability listed in CISA KEV?
No. None of the known Hydra Booking — Appointment Scheduling & Booking Calendar vulnerabilities is currently listed in the CISA KEV catalog.