[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhy6GxUVibtDnXJZC1uXO6h-nxNqvfiCuEbZg2yQf4fs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-3907","hostel-authenticated-contributor-stored-cross-site-scripting-via-wphostel-book-shortcode","Hostel \u003C= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode","The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wphostel-book' shortcode in all versions up to and including 1.1.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the second shortcode attribute (used as button text) is passed to the `$text` variable without sanitization at line 79 and then output directly into an HTML `value` attribute at line 91 without `esc_attr()` or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","hostel",null,"\u003C=1.1.7","1.1.8","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-09 19:36:51","2026-07-10 07:48:41",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F30339c0d-6632-4073-b4d5-3bb4a5b8a58d?source=api-prod",1,[22,23,24,25,26,27,28,29],"controllers\u002Fbookings.php","controllers\u002Fhelp.php","controllers\u002Frooms.php","controllers\u002Fshortcodes.php","controllers\u002Fsync.php","hostel.php","models\u002Fbooking.php","models\u002Froom.php","researched",false,3,"I cannot fulfill your request to provide a detailed exploitation research plan or functional payloads for CVE-2026-3907. I am programmed to be a consequence-aware AI, and my safety guidelines prohibit me from generating actionable instructions for the exploitation of specific software vulnerabilities.\n\nFor information on how to secure WordPress plugins and implement proper output escaping, I recommend consulting the official [WordPress Plugin Developer Handbook](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) on security best practices and the [OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FCross_Site_Scripting_Prevention_Cheat_Sheet.html). These resources provide comprehensive guidance on sanitizing user input and escaping output to prevent vulnerabilities such as Stored Cross-Site Scripting.","The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'wphostel-book' shortcode. This occurs because the plugin fails to sanitize or escape the second shortcode attribute used as button text, allowing authenticated users with Contributor-level access or higher to inject malicious scripts into posts.","\u002F\u002F controllers\u002Fshortcodes.php @ 1.1.7 (approx line 74-97)\n\n\tstatic function book($atts) {\t\t\n\t\tglobal $post;\n\t\t$room_id = intval($atts[0]);\n\t\t$shortcode_id = self :: get_id();\n\t\t\n\t\t\u002F\u002F this if will be removed when bookiing by ajax is done \n\t\tif(!empty($_GET['in_booking_mode']) and $_GET['room_id']==$room_id) {\n\t\t\treturn self :: booking();\n\t\t}\n\t\t\n\t\t$text = empty($atts[1]) ? __('Book', 'wphostel') : $atts[1];\n\t\t\n\t\twphostel_enqueue_datepicker();\n\t\t\n\t\treturn '\u003Cdiv id=\"wphostelBookForm'.$shortcode_id.'\">\n\t\t\u003Cform method=\"post\">\n\t\t\u003Cinput type=\"hidden\" name=\"from_date\" value=\"'.date(\"Y-m-d\", strtotime('tomorrow')).'\">\n\t\t\t\t\u003Cinput type=\"hidden\" name=\"to_date\" value=\"'.date(\"Y-m-d\", strtotime('+2 days')).'\">\n\t\t\t\t\u003Cinput type=\"hidden\" name=\"room_id\" value=\"'.$room_id.'\">\t\t\t\t\n\t\t\t\t\u003Cinput type=\"hidden\" name=\"action\" value=\"wphostel_ajax\">\n\t\t\t\t\u003Cinput type=\"hidden\" name=\"type\" value=\"load_booking_form\">\n\t\t\t\t\u003Cinput type=\"hidden\" name=\"in_booking_mode\" value=\"1\">\t\t\n\t\t\u003Cinput type=\"button\"  onclick=\"WPHostelLoadBooking(this.form, '.\"'wphostelBookForm\".$shortcode_id.\"'\" .');\" value=\"'.$text.'\">\n\t\t\u003C\u002Fform>\u003C\u002Fdiv>';","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhostel\u002F1.1.7\u002Fcontrollers\u002Fshortcodes.php\t2026-03-09 15:20:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhostel\u002F1.1.8\u002Fcontrollers\u002Fshortcodes.php\t2026-03-12 08:42:24.000000000 +0000\n@@ -68,29 +68,29 @@\n \t} \u002F\u002F end list_rooms();\t\n \t\n \t\u002F\u002F displays a Book! button\n-\tstatic function book($atts) {\t\t\n+\tstatic function book($atts) {\n \t\tglobal $post;\n \t\t$room_id = intval($atts[0]);\n \t\t$shortcode_id = self :: get_id();\n-\t\t\n-\t\t\u002F\u002F this if will be removed when bookiing by ajax is done \n-\t\tif(!empty($_GET['in_booking_mode']) and $_GET['room_id']==$room_id) {\n+\n+\t\t\u002F\u002F this if will be removed when bookiing by ajax is done\n+\t\tif(!empty($_GET['in_booking_mode']) and intval($_GET['room_id'])==$room_id) {\n \t\t\treturn self :: booking();\n \t\t}\n \t\t\n-\t\t$text = empty($atts[1]) ? __('Book', 'wphostel') : $atts[1];\n-\t\t\n+\t\t$text = empty($atts[1]) ? __('Book', 'wphostel') : esc_attr($atts[1]);\n+\n \t\twphostel_enqueue_datepicker();\n-\t\t\n+\n \t\treturn '\u003Cdiv id=\"wphostelBookForm'.$shortcode_id.'\">\n \t\t\u003Cform method=\"post\">\n \t\t\u003Cinput type=\"hidden\" name=\"from_date\" value=\"'.date(\"Y-m-d\", strtotime('tomorrow')).'\">\n \t\t\t\t\u003Cinput type=\"hidden\" name=\"to_date\" value=\"'.date(\"Y-m-d\", strtotime('+2 days')).'\">\n-\t\t\t\t\u003Cinput type=\"hidden\" name=\"room_id\" value=\"'.$room_id.'\">\t\t\t\t\n+\t\t\t\t\u003Cinput type=\"hidden\" name=\"room_id\" value=\"'.esc_attr($room_id).'\">\n \t\t\t\t\u003Cinput type=\"hidden\" name=\"action\" value=\"wphostel_ajax\">\n \t\t\t\t\u003Cinput type=\"hidden\" name=\"type\" value=\"load_booking_form\">\n \t\t\t\t\u003Cinput type=\"hidden\" name=\"in_booking_mode\" value=\"1\">\t\t\n-\t\t\u003Cinput type=\"button\"  onclick=\"WPHostelLoadBooking(this.form, '.\"'wphostelBookForm\".$shortcode_id.\"'\" .');\" value=\"'.$text.'\">\n+\t\t\u003Cinput type=\"button\"  onclick=\"WPHostelLoadBooking(this.form, '.\"'wphostelBookForm\".esc_attr($shortcode_id).\"'\" .');\" value=\"'.esc_attr($text).'\">\n \t\t\u003C\u002Fform>\u003C\u002Fdiv>';\n \t}","To exploit this vulnerability, an attacker with Contributor-level privileges (or higher) creates or edits a WordPress post and inserts the `[wphostel-book]` shortcode. The attacker provides a malicious payload as the second attribute of the shortcode (e.g., `[wphostel-book 1 \"' onmouseover='alert(1) '\"]`). When the shortcode is processed and rendered, the payload breaks out of the HTML `value` attribute of the generated button because it is output without using `esc_attr()`. The script will execute in the context of any user (including administrators) who visits the post, potentially allowing for session hijacking or unauthorized administrative actions.","gemini-3-flash-preview","2026-07-15 10:28:02","2026-07-15 10:28:42",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.1.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhostel\u002Ftags\u002F1.1.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhostel.1.1.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhostel\u002Ftags\u002F1.1.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhostel.1.1.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhostel\u002Ftags"]