PT-2026-33580 · Prasunsen · Hostel

Huy Tran · Published 2026-04-18 · Updated 2026-04-18 · CVE-2026-1838

Mitre

CVSS v3.1

6.1

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1838

Affected Products

Hostel

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1838 · Security Note
• https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/ajax.php#L28 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fhostel/tags/1.1.6&new_path=%2Fhostel/tags/1.1.7 · Note
• https://plugins.trac.wordpress.org/changeset/3478265/hostel/trunk/hostel.php · Note
• https://plugins.trac.wordpress.org/browser/hostel/trunk/views/partial/rooms-table.html.php#L29 · Note
• https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/hostel.php#L44 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2b9da491-771a-4100-b41a-7411981dd34b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/views/partial/rooms-table.html.php#L29 · Note
• https://plugins.trac.wordpress.org/browser/hostel/trunk/hostel.php#L44 · Note
• https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/ajax.php#L28 · Note