CVE-2026-1838

Affected software: Hostel plugin for WordPress (versions up to 1.1.6). Vulnerability: Reflected Cross-Site Scripting via the 'shortcode_id' parameter due to insufficient input sanitization and output escaping. Impact (as stated): Unauthenticated attackers can inject arbitrary web scripts into pag...