Extension WordPress
Vulnérabilités Hydra Booking , Appointment Scheduling & Booking Calendar
Cette page rassemble les failles publiées pour Hydra Booking , Appointment Scheduling & Booking Calendar, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Hydra Booking , Appointment Scheduling & Booking Calendar
12 fiches
Hydra Booking <= 1.2.1 – Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. This is due to the getBookingDetails() callback…
*-1.2.1
1.2.2
08/07/2026
Hydra Booking , Appointment Scheduling & Booking Calendar <= 1.1.44 – Unauthenticated Stored Cross-Site Scripting
The Hydra Booking , Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.44 due to insufficient input sanitization and output escaping. This makes it possible for…
*-1.1.44
1.1.45
08/07/2026
Hydra Booking , Appointment Scheduling & Booking Calendar <= 1.1.41 – Missing Authorization
The Hydra Booking , Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.1.41. This makes it possible for…
*-1.1.41
1.1.42
15/05/2026
Hydra Booking <= 1.1.38 – Authenticated (Hydra host+) Stored Cross-Site Scripting
The Hydra Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with hydra host-level access…
*-1.1.38
1.1.39
15/02/2026
Hydra Booking <= 1.1.32 – Unauthenticated Privilege Escalation
The Hydra Booking , Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to elevate their privileges to that…
*-1.1.32
1.1.33
21/01/2026
Hydra Booking <= 1.1.32 – Authenticated (Custom role+) SQL Injection
The Hydra Booking plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
*-1.1.32
1.1.33
27/11/2025
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 – Missing Payment Verification to Unauthenticated Payment Bypass
The Hydra Booking , Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled…
*-1.1.27
1.1.28
10/11/2025
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 – Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
The Hydra Booking , Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhb_meeting_form_submit_callback" function using insufficiently random values…
*-1.1.27
1.1.28
10/11/2025
Hydra Booking 1.1.0 – 1.1.18 – Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above,…
1.1.0-1.1.18
1.1.19
28/07/2025
Hydra Booking <= 1.1.9 – Missing Authorization
The Hydra Booking , Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.9. This makes it possible…
*-1.1.9
1.1.10
12/06/2025
Hydra Booking <= 1.1.10 – Authenticated (Subscriber+) SQL Injection
The Hydra Booking plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
*-1.1.10
1.1.11
12/06/2025
Hydra Booking <= 1.1.10 – Authenticated (Contributor+) SQL Injection
The Hydra Booking plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
*-1.1.10
1.1.11
05/06/2025
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.