Executive brief
The Hostel plugin for WordPress, used for managing hostel bookings, contains a security flaw that allows users with basic contributor permissions to inject malicious scripts into website pages. These scripts execute automatically when other users visit the affected pages, potentially leading to unauthorized actions or data theft. This impacts the integrity of the website and the security of its visitors.
Technical details
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'wphostel-book' shortcode attributes. Specifically, the second attribute (used for button text) is assigned to the $text variable and rendered directly into an HTML 'value' attribute without using esc_attr() or similar escaping functions. Authenticated attackers with Contributor-level permissions or higher can exploit this to inject malicious JavaScript. The vulnerability exists in all versions up to and including 1.1.7. A patch has been identified in recent changesets.
Affected products
- prasunsen Hostel up to and including 1.1.7
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
References
- https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/shortcodes.php
- https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/shortcodes.php
- https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/models/hostel.php
- https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/shortcodes.php
- https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/shortcodes.php
- https://plugins.trac.wordpress.org/browser/hostel/trunk/models/hostel.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3480942%40hostel&new=3480942%40hostel