CVE-2025-66119

Vulnerability

The Hostel plugin for WordPress suffers from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation. This affects all versions from n/a through 1.1.5.9 [1]. The vulnerability is classified as High severity with a CVSS v3 score of 7.1.

Exploitation

An attacker can exploit this by crafting a malicious link that, when clicked by a privileged user (e.g., an administrator), triggers the execution of arbitrary JavaScript in the context of the victim's browser. User interaction is required, but successful exploitation does not require authentication beyond the victim's session [1].

Impact

Successful exploitation allows an attacker to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, which execute when visitors access the affected site. This can lead to defacement, data theft, or further compromise of the WordPress installation [1].

Mitigation

The vulnerability has been patched in version 1.1.6 of the Hostel plugin. Users are strongly advised to update immediately. For those unable to update, Patchstack offers a mitigation rule to block attacks until the update is applied [1].