EUVD-2026-23624Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected XSS in Hostel WordPress plugin versions up to 1.1.6 allows unauthenticated attackers to inject arbitrary JavaScript via the 'shortcode_id' parameter, requiring user interaction (clicking a malicious link) to execute. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode handling code. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The Hostel plugin processes user-supplied input through the 'shortcode_id' parameter without proper sanitization before rendering it in HTML output. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw where untrusted data flows directly into the DOM. The affected code path involves WordPress shortcode processing (hostel.php line 44) that passes the parameter to AJAX handlers (controllers/ajax.php line 28) and ultimately to HTML template rendering (views/partial/rooms-table.html.php line 29). The plugin fails to use WordPress escaping functions (such as esc_attr(), esc_html(), or wp_kses_post()) when outputting the shortcode_id value, allowing malicious scripts to be reflected in responses sent to users' browsers.
RemediationAI
Upgrade the Hostel plugin to version 1.1.7 or later immediately via the WordPress plugin dashboard or by downloading the patched version from plugins.wordpress.org/plugins/hostel/. The fix includes proper input sanitization and output escaping of the 'shortcode_id' parameter in hostel.php, ajax.php, and the rooms-table.html.php template. If immediate upgrade is not possible, temporarily disable the Hostel plugin and use an alternative hostel booking solution until the patch can be applied. Site administrators should review their WordPress security update policies to ensure automatic updates are enabled for plugins, as plugin updates often contain critical security fixes that are not propagated automatically by default. For additional security context, visit the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9da491-771a-4100-b41a-7411981dd34b.
The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the pag
The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the pag
The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high pri
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high pri
Stored Cross-Site Scripting in the Hostel WordPress plugin (all versions through 1.1.7) permits authenticated Contributo
XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. Rated medium severity (CVSS 6.1), this vulnerability
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today