CVE-2026-3907

Name of the Vulnerable Software and Affected Versions Hostel versions prior to 1.1.8

Description Stored Cross-Site Scripting occurs via the 'wphostel-book' shortcode due to insufficient input sanitization and output escaping of user-supplied shortcode attributes. Specifically, the second shortcode attribute, used as button text, is assigned to the $text variable without sanitization and subsequently output into an HTML value attribute without using esc attr() or other escaping methods. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 1.1.7.