CVE-2026-1838

Affected software: Hostel plugin for WordPress (versions up to 1.1.6). Vulnerability: Reflected Cross-Site Scripting via the 'shortcode_id' parameter due to insufficient input sanitization and output escaping. Impact (as stated): Unauthenticated attackers can inject arbitrary web scripts into pag...

EUVD-2026-23624

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodeid' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-1838: Improper Neutralization of Input During Web Page Generation

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodeid' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress plugin Hostel 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

CVE-2021-25041: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting XSS issues via the bwgalbumbreadcrumb0 and shortcodeid GET parameters passed to the bwgfrontenddata AJAX action...

WordPress Photo Gallery 1.5.69 Cross Site Scripting Vulnerability

WordPress Photo Gallery plugin versions 1.5.69 and below suffer from multiple reflective cross site scripting vulnerabilities. WordPress Photo Gallery 1.5.69 Cross Site Scripting Vulnerability Researcher Name: ThuraMoeMyint Twitter: https://twitter.com/mgthuramoemyint Vendor Url:...