Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: prasunsen Component: Hostel Clear all filters
TI-2025-05642 CVE-2025-6236 · GHSA-3xqq-8r3c-qc6w

Hostel < 1.1.5.9 - Admin+ Stored XSS

Priority MEDIUM 55

The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_h…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00249 Published 2025-07-10 Fixed in 1.1.5.9 CWE-79
TI-2025-05640 CVE-2025-6234 · GHSA-4rpf-gc6c-w865

Hostel < 1.1.5.8 - Reflected XSS

Priority MEDIUM 60

The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00268 Published 2025-07-10 Fixed in 1.1.5.8 CWE-79
TI-2024-03499 CVE-2024-3753 · GHSA-j4vv-h88w-gmv9

Hostel < 1.1.5.3 - Reflected XSS

Priority MEDIUM 60

The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00801 Published 2024-07-13 Fixed in 1.1.5.3 CWE-79
TI-2023-00516 CVE-2023-0545 · GHSA-2j7r-32wv-4cfj

Hostel < 1.1.5.2 - Admin+ Stored XSS

Priority MEDIUM 55

The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_h…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00442 Published 2023-06-05 Fixed in 1.1.5.2