PT-2025-28984

CVE-2025-6236

Published

2025-06-19

Updated

2025-07-10

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Hostel WordPress plugin versions prior to 1.1.5.9

Description: The Hostel WordPress plugin does not properly sanitize and escape certain settings. This could allow users with high privileges, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks, even when the unfiltered html capability is disabled, for example, in a multi-site setup. Stored XSS attacks involve injecting malicious scripts into a website that are then stored and executed when other users visit the affected page.

Recommendations: Update the Hostel WordPress plugin to version 1.1.5.9 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Bob Matyas

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers