{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1838", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T16:31:20.729Z", "datePublished": "2026-04-18T01:26:04.643Z", "dateUpdated": "2026-04-18T01:26:04.643Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-18T01:26:04.643Z"}, "affected": [{"vendor": "prasunsen", "product": "Hostel", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9da491-771a-4100-b41a-7411981dd34b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/hostel.php#L44"}, {"url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/hostel.php#L44"}, {"url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/ajax.php#L28"}, {"url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/ajax.php#L28"}, {"url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/views/partial/rooms-table.html.php#L29"}, {"url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/views/partial/rooms-table.html.php#L29"}, {"url": "https://plugins.trac.wordpress.org/changeset/3478265/hostel/trunk/hostel.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fhostel/tags/1.1.6&new_path=%2Fhostel/tags/1.1.7"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "huy tran"}], "timeline": [{"time": "2026-04-17T11:44:41.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "id": "CVE-2026-1838", "lastModified": "2026-04-18T02:16:11.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-18T02:16:11.337", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/ajax.php#L28"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/hostel.php#L44"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/views/partial/rooms-table.html.php#L29"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/ajax.php#L28"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/hostel.php#L44"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/views/partial/rooms-table.html.php#L29"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3478265/hostel/trunk/hostel.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fhostel/tags/1.1.6&new_path=%2Fhostel/tags/1.1.7"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9da491-771a-4100-b41a-7411981dd34b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T08:41:32.318904+00:00", "value": {"mitigation_remediation": ["Upgrade the Hostel plugin to version 1.1.7 or later, which contains the necessary input sanitization.", "If an update cannot be performed immediately, disable or remove the shortcode that accepts the 'shortcode_id' parameter from publicly accessible pages to prevent reflection.", "Implement site\u2011wide output escaping or a reputable WordPress security plugin that scans for and blocks Cross\u2011Site Scripting payloads."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting due to reflected input in the 'shortcode_id' parameter, enabling arbitrary script execution in victim browsers"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Hostel plugin at any version up to and including 1.1.6 are affected. The flaw was present in all releases prior to the available 1.1.7 update, which appears to correct the sanitization issue.", "description_and_impact": "The Hostel WordPress plugin suffers from a reflected Cross\u2011Site Scripting flaw caused by insufficient input sanitization and output escaping for the 'shortcode_id' parameter. An attacker can craft a link containing malicious JavaScript that is reflected back to the victim\u2019s browser when the link is clicked, allowing the execution of arbitrary client\u2011side code. This can lead to session hijacking, credential theft, or malicious page manipulation for the user.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity. Because the flaw is remote and unauthenticated, an attacker only needs to convince a user to click a specially crafted URL; no credentials or local execution is required. The EPSS score is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting that exploitation may be limited to targeted or opportunistic attacks rather than widespread automated exploitation."}}}}, "created": "2026-04-18T08:45:41.382892+00:00", "updated": "2026-04-18T08:45:41.382911+00:00", "vendors": []}