WordPress · Hostel · CVE-2026-1838
**Name of the Vulnerable Software and Affected Versions**
Hostel versions prior to 1.1.7
**Description**
The Hostel plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages via the `shortcode id` parameter, which execute when a user is tricked into clicking a malicious link.
**Recommendations**
Update to a version later than 1.1.6.
As a temporary workaround, restrict or sanitize the use of the `shortcode id` parameter.