Is Hydra Booking safe?

Every recorded flaw

• Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not perform object-level authorisation checks on several of its host-management operationsCVE-2026-92425 · fixed in 1.2.4 · reported by WPScanMedium 5.5
• Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not verify that the host record being modified belongs to the user making the requestCVE-2026-92421 · fixed in 1.2.3 · reported by WPScanMedium 4.7
• Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpointsCVE-2026-92420 · fixed in 1.2.2 · reported by WPScanLow 3.8
• Aug 15, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Stored Cross-Site ScriptingCVE-2026-15948 · affects up to 1.2.2 · reported by WordfenceMedium 6.4
• Aug 13, 2026Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.CVE-2026-28188 · affects up to 1.2.2 · reported by PatchstackHigh 7.3
• Jul 13, 2026Hydra Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57388 · affects up to 1.1.44 · reported by PatchstackHigh 7.1
• Jul 9, 2026Hydra Booking – Appointment Scheduling & Booking Calendar: Insecure Direct Object ReferenceCVE-2026-12433 · affects up to 1.2.1 · reported by WordfenceMedium 4.3
• Jun 1, 2026Hydra Booking: Missing AuthorizationCVE-2026-42675 · affects up to 1.1.41 · reported by PatchstackHigh 7.3
• Apr 8, 2026Hydra Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39541 · affects up to 1.1.38 · reported by PatchstackMedium 5.9
• Jan 22, 2026Hydra Booking: Incorrect Privilege AssignmentCVE-2025-68027 · affects up to 1.1.32 · reported by PatchstackHigh 7.3
• Dec 16, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68055 · affects up to 1.1.32 · reported by PatchstackHigh 8.5
• Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Missing payment verification to unauthenticated payment bypassCVE-2025-12788 · affects up to 1.1.27 · reported by WordfenceMedium 5.3
• Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Unauthorized booking cancellationCVE-2025-12787 · affects up to 1.1.27 · reported by WordfenceMedium 5.3
• Oct 22, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49378 · affects up to 1.1.10 · reported by PatchstackHigh 8.5
• Oct 22, 2025Hydra Booking: Missing AuthorizationCVE-2025-49377 · affects up to 1.1.9 · reported by PatchstackMedium 6.3
• Jul 29, 2025Hydra Booking: Privilege EscalationCVE-2025-7689 · affects 1.1.0 to 1.1.18 · reported by WordfenceHigh 8.8
• Jun 6, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49323 · affects up to 1.1.10 · reported by PatchstackHigh 8.5

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.