CVE-2026-1645: WordPress Hostel Plugin XSS Vulnerability

CVE-2026-1645 Overview

The Hostel plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.1.8. The flaw exists in the custom_currency parameter and the locale_url setting, where the plugin fails to properly sanitize input and escape output. Authenticated attackers with Administrator-level access can inject arbitrary web scripts that execute when users visit affected pages. The vulnerability only impacts multi-site WordPress installations and installations where the unfiltered_html capability has been disabled. The issue is tracked under [CWE-79] and referenced by Wordfence as vulnerability ID 75693bd1.

Critical Impact
Authenticated administrators on WordPress multi-site installations can inject persistent JavaScript that executes in the browsers of any user viewing affected pages, enabling session theft and account takeover.

Affected Products

WordPress Hostel plugin versions up to and including 1.1.8
WordPress multi-site installations running the Hostel plugin
WordPress installations with unfiltered_html capability disabled

Discovery Timeline

2026-09-22 - CVE-2026-1645 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-1645

Vulnerability Analysis

The Hostel plugin exposes two injection sinks that accept administrator-controlled input without adequate sanitization. The custom_currency parameter and the locale_url setting are stored in plugin configuration and later rendered in plugin views without proper output escaping. When a subsequent page load renders the stored values, the browser executes attacker-supplied JavaScript in the context of the WordPress site.

Because the injection points sit behind administrator authentication, exploitation requires attacker access to a privileged account. On single-site installations with the unfiltered_html capability enabled, administrators are already permitted to post raw HTML, so the flaw is not treated as a security boundary. The vulnerability becomes relevant on WordPress multi-site networks and configurations that revoke unfiltered_html, where administrators are expected to remain constrained by output escaping.

Root Cause

The root cause is insufficient input sanitization and missing output escaping in the plugin's HTML helper and options view. Public references point to specific code locations in the plugin repository: helpers/htmlhelper.php at lines 275 and 278, models/hostel.php at line 266, and views/options.php at line 17. These locations handle configuration values that reach the DOM without passing through WordPress escaping functions such as esc_html, esc_attr, or esc_url.

Attack Vector

An authenticated administrator submits a plugin configuration update containing JavaScript payloads in the custom_currency parameter or the locale_url setting. The plugin stores the payload in the WordPress options table. When any user, including higher-privileged network administrators on multi-site deployments, visits a page that renders the stored setting, the script executes in that user's browser session. This enables session cookie theft, forced administrative actions via cross-site request forgery pivots, and persistence through additional stored payloads.

The vulnerability is described in prose because no verified proof-of-concept code has been published. Refer to the Wordfence advisory for additional technical details.

Detection Methods for CVE-2026-1645

Indicators of Compromise

Unexpected <script>, onerror, or javascript: content stored in the WordPress wp_options table under Hostel plugin keys
Non-URL content or encoded JavaScript stored in the locale_url setting
Currency symbol fields containing HTML tags or event handlers instead of standard currency strings
Outbound requests from administrator browsers to attacker-controlled domains shortly after visiting hostel-related admin pages

Detection Strategies

Query the wp_options table for Hostel plugin settings and match values against patterns containing <script, on\w+=, or javascript:
Enable WordPress audit logging to record plugin option changes and identify administrator accounts modifying custom_currency or locale_url
Deploy a web application firewall rule that inspects POST requests to Hostel plugin option endpoints for HTML tags in currency and URL fields
Baseline plugin option values in staging and alert on production drift for the affected settings

Monitoring Recommendations

Monitor administrator login events on multi-site super-admin and site-admin roles for anomalous source addresses
Log and review Content Security Policy (CSP) violations reported by administrator browsers on wp-admin pages
Track file integrity of the Hostel plugin directory to detect tampering that could reintroduce the sink
Correlate WordPress user activity with browser telemetry to identify script execution triggered by stored settings

How to Mitigate CVE-2026-1645

Immediate Actions Required

Update the Hostel plugin to a version later than 1.1.8 once a patched release is available from the plugin maintainer
Audit the custom_currency and locale_url values in wp_options and remove any HTML or script content
Restrict administrator account creation on multi-site networks and enforce multi-factor authentication for all privileged users
Review recent audit logs for unauthorized changes to Hostel plugin settings

Patch Information

At the time of publication, the advisory identifies all versions up to and including 1.1.8 as vulnerable. Consult the Wordfence advisory and the WordPress plugin repository for the latest fixed release. Verify that the patched version applies esc_url, esc_attr, or esc_html to the affected sinks.

Workarounds

Deactivate the Hostel plugin on multi-site installations until a patched version is available
Restore the unfiltered_html capability only for trusted single-site administrators to avoid depending on the affected escaping paths
Deploy a Content Security Policy that blocks inline scripts on wp-admin pages to limit payload execution
Apply a WAF virtual patch that strips HTML characters from custom_currency and validates locale_url as a well-formed URL

bash

# Example WordPress WP-CLI command to inspect Hostel plugin options
wp option get hostel_settings --format=json | grep -Ei 'script|onerror|javascript:'