CVE-2026-15948 is a stored cross-site scripting vulnerability in the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin. The flaw arises from insufficient input sanitization and output escaping of the 'first_name' parameter. Authenticated attackers with the tfhb_host role can inject arbitrary web scripts into pages, which execute upon page access. Since the tfhb_host role can be self-assigned by any visitor via the public Signup shortcode, unauthenticated users who complete registration can exploit this vulnerability. This affects all versions up to and including 1.2.2.

Successful exploitation allows injection and execution of arbitrary scripts in the context of affected pages, potentially leading to data theft, session hijacking, or other malicious actions within the user's browser. The vulnerability is exploitable by unauthenticated users due to the ability to self-assign the required role, increasing the risk of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor the use of the Signup shortcode to prevent unauthorized role assignment. Consider disabling or limiting the plugin's registration features to reduce exposure.