EUVD-2026-42842
GHSA-9hmh-43jg-fm2x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L confirmed by required Contributor account; UI:R applied because a victim must visit the injected page to trigger payload execution; S:C reflects cross-browser scope change inherent to stored XSS.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wphostel-book' shortcode in all versions up to and including 1.1.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the second shortcode attribute (used as button text) is passed to the $text variable without sanitization at line 79 and then output directly into an HTML value attribute at line 91 without esc_attr() or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Hostel WordPress plugin (all versions through 1.1.7) permits authenticated Contributor-level users to permanently inject arbitrary JavaScript into WordPress pages via the second attribute of the wphostel-book shortcode, which is passed unsanitized to the $text variable and rendered raw into an HTML value attribute without esc_attr() escaping. Any user who subsequently views an injected page will execute the attacker's payload in their browser, enabling session hijacking or privilege escalation against higher-privileged site users. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; the primary risk is to WordPress sites that grant Contributor access to untrusted or semi-trusted users.
Technical ContextAI
The affected component is the wphostel-book shortcode handler within controllers/shortcodes.php of the Hostel plugin (CPE: cpe:2.3:a:prasunsen:hostel:*:*:*:*:*:*:*:*), a WordPress accommodation/hostel booking plugin by developer prasunsen. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: at line 79 of shortcodes.php, the second positional shortcode attribute intended as button label text is assigned to $text without any sanitization call such as sanitize_text_field(); at line 91, this unsanitized value is embedded directly into an HTML value attribute without the mandatory WordPress escaping function esc_attr(). WordPress shortcode attributes are user-controllable input and must be treated as untrusted; the absence of both server-side sanitization and context-aware output escaping creates a classic dual-failure stored XSS pathway. The companion file models/hostel.php at line 195 may also be involved in the data flow per the trac references.
RemediationAI
A fix commit has been pushed to the Hostel plugin trunk in the WordPress plugin repository, as indicated by the changeset reference at https://plugins.trac.wordpress.org/changeset?reponame=&old=3480942%40hostel&new=3480942%40hostel; however, no specific patched release version number (e.g., 1.1.8 or later) is independently confirmed from the available data - site administrators should update to the latest available version via the WordPress admin dashboard and verify the installed version exceeds 1.1.7. As an immediate workaround, administrators should audit and restrict Contributor role assignments to only fully trusted users, since the attack requires that level of access; removing Contributor access from untrusted or inactive accounts eliminates exploitation risk entirely without disabling the plugin. If the plugin cannot be updated promptly and Contributor access cannot be restricted, deactivating the Hostel plugin removes the attack surface until a confirmed patched release can be applied. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/30339c0d-6632-4073-b4d5-3bb4a5b8a58d provides additional remediation context.
The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the pag
The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the pag
The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high pri
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high pri
Reflected XSS in Hostel WordPress plugin versions up to 1.1.6 allows unauthenticated attackers to inject arbitrary JavaS
XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. Rated medium severity (CVSS 6.1), this vulnerability
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today