The Hydra Booking plugin for WordPress stores user input without proper escaping, allowing a stored cross‑site scripting flaw described as CWE‑79. When the malicious input is later displayed on a page, it can execute arbitrary JavaScript in the browsers of anyone who views that page, potentially leading to session hijacking, credential theft, site defacement, or loading of additional malicious scripts.

WordPress installations that include the Themefic Hydra Booking plugin version 1.1.38 or earlier are affected. All releases listed in the vulnerability notice share the same input neutralization problem.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely at present. The vulnerability is not included in the CISA KEV catalog, implying no widespread exploitation has been reported. Based on the description, the likely attack vector is a user—either malicious or innocently—submitting crafted booking data that is stored and later rendered to other visitors. If the stored input succeeds, the injected script runs in the victim’s browser, creating the potential for ad‑ware deployment, information theft, or further compromise. Monitoring for activity and applying remediation promptly are therefore advised.