CVE-2026-76586

BookingPress WordPress plugin (Appointment Booking Calendar Plugin and Scheduling Plugin), versions 1.5.6 through 1.6.2 , fails to verify the amount actually paid against the server-side price staged for a booking when confirming an online payment. The issue manifests via PayPal payment confirmat...

CVE-2025-12788

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the...

EUVD-2025-84360

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the...