What is the CVSS score of CVE-2026-1838?

CVE-2026-1838 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-1838

EUVD-2026-23624 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-18 Wordfence

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 18, 2026 - 01:52 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 01:45 euvd

EUVD-2026-23624

Analysis Generated

Apr 18, 2026 - 01:45 vuln.today

CVE Published

Apr 18, 2026 - 01:26 nvd

MEDIUM 6.1

DescriptionCVE.org

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected XSS in Hostel WordPress plugin versions up to 1.1.6 allows unauthenticated attackers to inject arbitrary JavaScript via the 'shortcode_id' parameter, requiring user interaction (clicking a malicious link) to execute. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode handling code. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The Hostel plugin processes user-supplied input through the 'shortcode_id' parameter without proper sanitization before rendering it in HTML output. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw where untrusted data flows directly into the DOM. The affected code path involves WordPress shortcode processing (hostel.php line 44) that passes the parameter to AJAX handlers (controllers/ajax.php line 28) and ultimately to HTML template rendering (views/partial/rooms-table.html.php line 29). The plugin fails to use WordPress escaping functions (such as esc_attr(), esc_html(), or wp_kses_post()) when outputting the shortcode_id value, allowing malicious scripts to be reflected in responses sent to users' browsers.

RemediationAI

Upgrade the Hostel plugin to version 1.1.7 or later immediately via the WordPress plugin dashboard or by downloading the patched version from plugins.wordpress.org/plugins/hostel/. The fix includes proper input sanitization and output escaping of the 'shortcode_id' parameter in hostel.php, ajax.php, and the rooms-table.html.php template. If immediate upgrade is not possible, temporarily disable the Hostel plugin and use an alternative hostel booking solution until the patch can be applied. Site administrators should review their WordPress security update policies to ensure automatic updates are enabled for plugins, as plugin updates often contain critical security fixes that are not propagated automatically by default. For additional security context, visit the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9da491-771a-4100-b41a-7411981dd34b.