What’s Vulnerable › Products

themefic Hydra Booking — Appointment Scheduling & Booking Calendar vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your themefic Hydra Booking — Appointment Scheduling & Booking Calendar version is affected

Latest themefic Hydra Booking — Appointment Scheduling & Booking Calendar vulnerabilities

• CVE-2026-15948 — Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter (CVSS 6.4)
• CVE-2026-12433 — Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter (CVSS 4.3)
• CVE-2025-12788 — Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass (CVSS 5.3)
• CVE-2025-12787 — Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation (CVSS 5.3)