2026-04-19 · 2 min · BitNinja Team

New XSS Vulnerability in WordPress Hostel Plugin

The recently discovered vulnerability, CVE-2026-1838, affects the Hostel plugin for WordPress, particularly versions up to 1.1.6. This vulnerability allows attackers to exploit reflected Cross-Site Scripting (XSS) via the 'shortcodeid' parameter due to inadequate input sanitiz...