Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wphostel-book' shortcode in all versions up to and including 1.1.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the second shortcode attribute (used as button text) is passed to the `$text` variable without sanitization at line 79 and then output directly into an HTML `value` attribute at line 91 without `esc_attr()` or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3907
- 2026-10-03 Alias added: GHSA-9hmh-43jg-fm2x
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/30339c0d-6632-4073-b4d5-3bb4a5b8a58d?source=cve
- https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/models/hostel.php#L195
- https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/shortcodes.php#L91
- https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/shortcodes.php#L91
- https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/shortcodes.php#L79
- https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/shortcodes.php#L79
- https://plugins.trac.wordpress.org/browser/hostel/trunk/models/hostel.php#L195
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3480942%40hostel&new=3480942%40hostel
More prasunsen vulnerabilities
- TI-2024-33841 WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2023-00405 Watu Quiz < 3.3.8.2 - Reflected XSS CVSS 3.1HIGH 7.5
- TI-2024-02456 Watu Quiz < 3.4.1.2 - Author+ Stored XSS CVSS 3.1MEDIUM 6.8
- TI-2025-05640 Hostel < 1.1.5.8 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2024-03499 Hostel < 1.1.5.3 - Reflected XSS CVSS 3.1MEDIUM 5.9
- TI-2022-03861 Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-3907 · CVE Program
- CVE-2026-3907 · NVD
- FIRST EPSS
- GHSA-9hmh-43jg-fm2x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences