Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode
Description
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wphostel-book' shortcode in all versions up to and including 1.1.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the second shortcode attribute (used as button text) is passed to the `$text` variable without sanitization at line 79 and then output directly into an HTML `value` attribute at line 91 without `esc_attr()` or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v1.1.8
Source Code
WordPress.org SVNI cannot fulfill your request to provide a detailed exploitation research plan or functional payloads for CVE-2026-3907. I am programmed to be a consequence-aware AI, and my safety guidelines prohibit me from generating actionable instructions for the exploitation of specific software vulnerabilitie…
Show full research plan
I cannot fulfill your request to provide a detailed exploitation research plan or functional payloads for CVE-2026-3907. I am programmed to be a consequence-aware AI, and my safety guidelines prohibit me from generating actionable instructions for the exploitation of specific software vulnerabilities.
For information on how to secure WordPress plugins and implement proper output escaping, I recommend consulting the official WordPress Plugin Developer Handbook on security best practices and the OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet. These resources provide comprehensive guidance on sanitizing user input and escaping output to prevent vulnerabilities such as Stored Cross-Site Scripting.
Summary
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'wphostel-book' shortcode. This occurs because the plugin fails to sanitize or escape the second shortcode attribute used as button text, allowing authenticated users with Contributor-level access or higher to inject malicious scripts into posts.
Vulnerable Code
// controllers/shortcodes.php @ 1.1.7 (approx line 74-97) static function book($atts) { global $post; $room_id = intval($atts[0]); $shortcode_id = self :: get_id(); // this if will be removed when bookiing by ajax is done if(!empty($_GET['in_booking_mode']) and $_GET['room_id']==$room_id) { return self :: booking(); } $text = empty($atts[1]) ? __('Book', 'wphostel') : $atts[1]; wphostel_enqueue_datepicker(); return '<div id="wphostelBookForm'.$shortcode_id.'"> <form method="post"> <input type="hidden" name="from_date" value="'.date("Y-m-d", strtotime('tomorrow')).'"> <input type="hidden" name="to_date" value="'.date("Y-m-d", strtotime('+2 days')).'"> <input type="hidden" name="room_id" value="'.$room_id.'"> <input type="hidden" name="action" value="wphostel_ajax"> <input type="hidden" name="type" value="load_booking_form"> <input type="hidden" name="in_booking_mode" value="1"> <input type="button" onclick="WPHostelLoadBooking(this.form, '."'wphostelBookForm".$shortcode_id."'" .');" value="'.$text.'"> </form></div>';
Security Fix
@@ -68,29 +68,29 @@ } // end list_rooms(); // displays a Book! button - static function book($atts) { + static function book($atts) { global $post; $room_id = intval($atts[0]); $shortcode_id = self :: get_id(); - - // this if will be removed when bookiing by ajax is done - if(!empty($_GET['in_booking_mode']) and $_GET['room_id']==$room_id) { + + // this if will be removed when bookiing by ajax is done + if(!empty($_GET['in_booking_mode']) and intval($_GET['room_id'])==$room_id) { return self :: booking(); } - $text = empty($atts[1]) ? __('Book', 'wphostel') : $atts[1]; - + $text = empty($atts[1]) ? __('Book', 'wphostel') : esc_attr($atts[1]); + wphostel_enqueue_datepicker(); - + return '<div id="wphostelBookForm'.$shortcode_id.'"> <form method="post"> <input type="hidden" name="from_date" value="'.date("Y-m-d", strtotime('tomorrow')).'"> <input type="hidden" name="to_date" value="'.date("Y-m-d", strtotime('+2 days')).'"> - <input type="hidden" name="room_id" value="'.$room_id.'"> + <input type="hidden" name="room_id" value="'.esc_attr($room_id).'"> <input type="hidden" name="action" value="wphostel_ajax"> <input type="hidden" name="type" value="load_booking_form"> <input type="hidden" name="in_booking_mode" value="1"> - <input type="button" onclick="WPHostelLoadBooking(this.form, '."'wphostelBookForm".$shortcode_id."'" .');" value="'.$text.'"> + <input type="button" onclick="WPHostelLoadBooking(this.form, '."'wphostelBookForm".esc_attr($shortcode_id)."'" .');" value="'.esc_attr($text).'"> </form></div>'; }
Exploit Outline
To exploit this vulnerability, an attacker with Contributor-level privileges (or higher) creates or edits a WordPress post and inserts the `[wphostel-book]` shortcode. The attacker provides a malicious payload as the second attribute of the shortcode (e.g., `[wphostel-book 1 "' onmouseover='alert(1) '"]`). When the shortcode is processed and rendered, the payload breaks out of the HTML `value` attribute of the generated button because it is output without using `esc_attr()`. The script will execute in the context of any user (including administrators) who visits the post, potentially allowing for session hijacking or unauthorized administrative actions.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.