CVE-2026-39541
Stored XSS in Themefic Hydra Booking ≤ 1.1.38 Allows Code Injection
Publication date: 2026-04-08
Last updated on: 2026-04-10
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themefic | hydra_booking | to 1.1.38 (inc) |
| themefic | hydra_booking | From 1.1.0 (inc) to 1.1.38 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to inject malicious scripts into affected websites, which could lead to unauthorized actions or data exposure when visitors access the site.
Such Cross-site Scripting (XSS) vulnerabilities can potentially impact compliance with standards like GDPR or HIPAA by increasing the risk of unauthorized access or manipulation of user data.
However, exploitation requires a privileged user role and user interaction, which may limit the risk and impact.
Users are strongly advised to update to the patched version 1.1.39 or later to mitigate this risk and help maintain compliance.
Can you explain this vulnerability to me?
CVE-2026-39541 is a Cross Site Scripting (XSS) vulnerability in the WordPress Hydra Booking Plugin versions up to and including 1.1.38. It occurs due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into affected websites.
These malicious scripts can include redirects, advertisements, or other harmful HTML payloads that execute when visitors access the compromised site.
Exploitation requires a privileged user role, specifically the Hydra Host Developer, to interact with a crafted link, page, or form, meaning user interaction is necessary for the attack to succeed.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts on your website, potentially leading to unauthorized redirects, display of unwanted advertisements, or other harmful actions affecting site visitors.
Because exploitation requires a privileged user role and user interaction, the risk is considered moderate with a CVSS score of 5.9.
While it can be exploited in mass campaigns targeting many websites, the overall threat is considered low priority with no impactful threat expected.
To mitigate the risk, it is strongly advised to update the plugin to version 1.1.39 or later, where the vulnerability is patched.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability is a Stored Cross Site Scripting (XSS) issue in the WordPress Hydra Booking Plugin versions up to and including 1.1.38. Detection involves identifying if the vulnerable plugin version is installed and if malicious scripts have been injected.
Since exploitation requires a privileged user role (Hydra Host Developer) to interact with crafted inputs, monitoring for unusual input submissions or script injections in plugin-related pages can help detect exploitation attempts.
Specific commands are not provided in the resources, but general detection steps include:
- Check the installed version of the Hydra Booking plugin to see if it is version 1.1.38 or earlier.
- Search the website database or files for suspicious injected scripts or HTML payloads related to the plugin.
- Monitor web server logs for unusual requests or inputs targeting the plugin's pages.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to update the Hydra Booking plugin to version 1.1.39 or later, where the vulnerability is patched.
Additionally, consider enabling auto-updates for the plugin if supported, to ensure timely application of future patches.
Since exploitation requires privileged user interaction, review and limit user roles and permissions to reduce risk.