Hostel WordPress Plugin CVE-2026-1645

Exploitation requires an authenticated account with Administrator-level access to the WordPress site, AND one of two non-default deployment conditions: the installation must be a WordPress multi-site network, OR the unfiltered_html capability must have been explicitly disabled. On a standard single-site install, Administrators retain unfiltered_html and can already post arbitrary scripts, so no security boundary is crossed and the issue does not apply. The payload is injected via the plugin's 'custom_currency' parameter or 'locale_url' setting; a separate victim (any user) must then view the injected page for the script to fire. These layered prerequisites - high privilege plus non-default configuration plus victim page view - substantially limit realistic exploitation.

This is a low-priority stored XSS with a self-consistent but weak risk profile. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N = 4.4 Medium) requires Administrator-level privileges (PR:H) and high attack complexity (AC:H), reflecting the description's explicit gating: the flaw ONLY manifests on multi-site installations or where unfiltered_html has been disabled. On a standard single-site WordPress install, Administrators already possess the unfiltered_html capability and can legitimately post arbitrary HTML/JS, so no privilege boundary is crossed and this is not a vulnerability there - matching AC:H. The scope change (S:C) and low C/I impacts reflect script execution in visitors' browser context. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so all severity weight rests on the vendor (Wordfence) CVSS. Given that exploitation presupposes an attacker already holding admin credentials, the realistic incremental risk is marginal - an admin attacker has far more direct paths to compromise. There are no conflicting signals: the network vector is consistent with stored-then-rendered XSS, and the high-privilege requirement is consistent with the multisite/unfiltered_html gating.

On a WordPress multisite network (or a site where unfiltered_html is disabled), an authenticated Administrator saves a malicious script into the plugin's 'custom_currency' parameter or 'locale_url' setting. The unsanitized value is later rendered without escaping on pages, and the injected JavaScript executes in the browser of any user who views the affected page. No public exploit code is identified at time of analysis, and the requirement for Administrator access plus a non-default configuration sharply limits real-world exploitability.