Hydra Booking — Appointment Scheduling & Booking Calendar

A complete appointment scheduling and booking calendar for WordPress — integrates with WooCommerce, Google Calendar, Zoom, and more.

v1.2.0ThemeficUpdated Added 2k+ installs88% rating
25
Score
238
Errors
707
Warnings
+0
Change

Category Scores

Security0
Repo100
Performance100
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

945 findings

Maintainability

568

10 issue groups

Security

306

11 issue groups

I18n

40

4 issue groups

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Bookmark".236
Category
Maintainability
Occurrences
236
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Bookmark".

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.120
Category
Maintainability
Occurrences
120
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().112
Category
Maintainability
Occurrences
112
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $query53
Category
Security
Occurrences
53
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $query

WARNINGSecurityRequest data is not unslashed$_GET['hash'] not unslashed before sanitization. Use wp_unslash() or similar53
Category
Security
Occurrences
53
Severity
warning

Sample message

$_GET['hash'] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $booking_table at "SELECT $table_name.*, COUNT($booking_table.id) as total_booking, $host_table.first_name as host_first_name, $host_table.last_name as host_last_name FROM $table_name\n52
Category
Security
Occurrences
52
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $booking_table at "SELECT $table_name.*, COUNT($booking_table.id) as total_booking, $host_table.first_name as host_first_name, $host_table.last_name as host_last_name FROM $table_name\n

ERRORSecurityDatabase parameter is not escapedUnescaped parameter $booking_table used in $wpdb->get_results()\n$booking_table assigned unsafely at line 176.45
Category
Security
Occurrences
45
Severity
error

Sample message

Unescaped parameter $booking_table used in $wpdb->get_results()\n$booking_table assigned unsafely at line 176.

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$bookmark['title']'.33
Category
Security
Occurrences
33
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$bookmark['title']'.

WARNINGMaintainabilitySchema ChangeAttempting a database schema change is discouraged.28
Category
Maintainability
Occurrences
28
Severity
warning

Sample message

Attempting a database schema change is discouraged.

ERRORI18nText Domain MismatchMismatched text domain. Expected 'hydra-booking' but got 'fluent-booking'.24
Category
I18n
Occurrences
24
Severity
error

Sample message

Mismatched text domain. Expected 'hydra-booking' but got 'fluent-booking'.

Show 15 more
WARNINGMaintainabilityslow db query meta key23
Category
Maintainability
Occurrences
23
Severity
warning

Sample message

Detected usage of meta_key, possible slow query.

ERRORMaintainabilitycurl curl setopt23
Category
Maintainability
Occurrences
23
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WARNINGSecurityNonce verification recommended20
Category
Security
Occurrences
20
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGSecurityInput is not validated19
Category
Security
Occurrences
19
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST['attendee_time_zone']. Check that the array index exists before using it.

WARNINGSecurityInput is not sanitized18
Category
Security
Occurrences
18
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['code']

ERRORMaintainabilitydate date11
Category
Maintainability
Occurrences
11
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

ERRORI18nMissing Translators Comment11
Category
I18n
Occurrences
11
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

WARNINGSecuritywp redirect wp redirect5
Category
Security
Occurrences
5
Severity
warning

Sample message

wp_redirect() found. Using wp_safe_redirect(), along with the "allowed_redirect_hosts" filter if needed, can help avoid any chances of malicious redirects within code. It is also important to remember to call exit() after a redirect so that no other unwanted code is executed.

ERRORMaintainabilitycurl curl close5
Category
Maintainability
Occurrences
5
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

ERRORMaintainabilitycurl curl exec5
Category
Maintainability
Occurrences
5
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

ERRORMaintainabilitycurl curl init5
Category
Maintainability
Occurrences
5
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WARNINGSecurityDatabase parameter is not escaped4
Category
Security
Occurrences
4
Severity
warning

Sample message

Unescaped parameter $table used in $wpdb->get_results()\n$table assigned unsafely at line 167.

WARNINGSecurityMissing nonce verification4
Category
Security
Occurrences
4
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORI18nNon Singular String Literal Text3
Category
I18n
Occurrences
3
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: 'This is an automated email from ' . get_bloginfo( 'name' ) . ', please do not reply.'

WARNINGI18nDiscouraged text-domain loading2
Category
I18n
Occurrences
2
Severity
warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

External Connections

Potential connections found in static code analysis.

35 domains

Outbound calls

167

External assets

1

Incoming endpoints

100

Notable Domains

hydrabooking.com16 · outbound
api.zoom.us12 · outbound
googleapis.com8 · outbound
loading.io6 · outbound
appsero.com4 · outbound
portal.themefic.com4 · outbound

Platform / Reference Domains

w3.org77 · platform/reference
ps.w.org4 · platform/reference
github.com3 · platform/reference
gnu.org1 · platform/reference

External Asset Domains

Incoming Endpoints

/wp-json/hydra-booking/v1/booking/(?P<id>[0-9]+)REST

register_rest_route

/wp-json/hydra-booking/v1/booking/availabletimeREST

register_rest_route

/wp-json/hydra-booking/v1/booking/bulk-updateREST

register_rest_route

/wp-json/hydra-booking/v1/booking/cancel-booking-attendeeREST

register_rest_route

/wp-json/hydra-booking/v1/booking/change-attendee-statusREST

register_rest_route

/wp-json/hydra-booking/v1/booking/change-booking-statusREST

register_rest_route

Admin AJAX endpoints4
admin_post_hydra-booking_fupcauthenticated

admin_post

admin_post_HydraBooking_el_activate_licenseauthenticated

admin_post

admin_post_HydraBooking_el_deactivate_licenseauthenticated

admin_post

wp_ajax_appsero_refresh_license_authenticated

wp_ajax

Score History

2 score snapshots

+0
1007550250Jun 21, 2026, 03:18 PM UTC Score 25/100 Plugin v1.1.45 Plugin Check 2.0.0 238 errors, 707 warningsJun 24, 2026, 09:06 AM UTC Score 25/100 Plugin v1.2.0 Plugin Check 2.0.0 238 errors, 707 warningsJun 21, 2026Jun 24, 2026

v1.2.0

25

Latest

Findings
945
Errors
238
Warnings
707
Check
2.0.0

v1.1.45

25

Score

Findings
945
Errors
238
Warnings
707
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins

Cal.com

1k+ active installs

99
Calendar

4k+ active installs

99
Hydrogen Calendar Embeds

900 active installs

99
ICS Calendar

10k+ active installs

99