Executive brief
The Hostel plugin for WordPress, used to manage hostel bookings and reservations, fails to properly sanitize user inputs in the custom_currency parameter and locale_url setting. An authenticated administrator can inject malicious JavaScript code that persists in the database and executes in the browsers of any user who visits an affected page, potentially compromising site visitors' sessions or data.
Technical details
The vulnerability is a stored XSS issue in the Hostel plugin due to insufficient input sanitization and output escaping of the custom_currency parameter and locale_url setting. The attack requires Administrator-level authentication on multi-site WordPress installations or installations where the unfiltered_html capability is disabled. Injected JavaScript executes in the context of any user accessing the affected page.
Affected products
- Hostel Plugin Hostel up to and including 1.1.8
Timeline
- 2026-09-22: disclosed