CVE-2026-15948 describes a stored cross-site scripting vulnerability in the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin. The flaw exists in all versions up to and including 1.2.2 due to improper neutralization of input in the 'first_name' parameter. An attacker can inject malicious scripts that execute when a user accesses the affected page. The exploit requires the 'tfhb_host' role, which can be self-assigned by any visitor through the plugin's public Signup shortcode, effectively allowing unauthenticated exploitation.

Successful exploitation allows an attacker to inject and execute arbitrary web scripts in the context of users visiting the affected pages. This can lead to information disclosure and limited integrity impact. The vulnerability does not affect availability. Because the required role can be self-assigned by unauthenticated users, the attack surface is broad.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting access to the Signup shortcode functionality to prevent unauthorized role assignment and script injection.