CVE-2026-15948

creationtimestamp| type| source ---|---|--- 2026-08-15 16:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mt532k4nug2g...

CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...