The Hydra Booking plugin for WordPress is vulnerable to a stored cross‑site scripting flaw because the ‘first_name’ parameter is not properly sanitised or escaped. An attacker can inject malicious JavaScript that will run whenever a page that displays that value is viewed. This can lead to session hijacking, cookie theft, or defacement of the site. The weakness is a classic input validation problem, identified as CWE‑79.

The issue affects all installations of the Hydra Booking – Appointment Scheduling & Booking Calendar plugin by themefic that are version 1.2.2 or earlier. These installations run within WordPress sites where the plugin is enabled.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Although the description labels the vector as authenticated (host+), the plugin allows any visitor to self‑assign the tfhb_host role through its public signup shortcode. This effectively turns the exploit into an unauthenticated one, increasing the likelihood that an attacker could inject scripts without special credentials.