CVE-2026-1645

Name of the Vulnerable Software and Affected Versions Hostel plugin for WordPress versions prior to 1.1.9

Description Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to perform Stored Cross-Site Scripting. This issue occurs via the custom currency parameter and the locale url setting. It specifically affects multi-site installations and environments where unfiltered html has been disabled, enabling the injection of arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update the Hostel plugin for WordPress to version 1.1.9 or later.