4.8Media

CVE-2025-6236Hostel < 1.1.5.9 - Admin+ Stored XSS

Hostel Publicada: 2025-07-10 09:00 (hace 1 año)

Descripción

The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
kibokolabs	hostel	< 1.1.5.9
—	Hostel	< 1.1.5.9

Referencias y parches

https://wpscan.com/vulnerability/ff4d312b-a4d1-40cd-a555-a0a1b46f9959/ exploitvdb-entrytechnical-descriptionExploit

Coincidencias CPE (NVD) (1)

cpe:2.3:a:kibokolabs:hostel:*:*:*:*:*:wordpress:*:* < 1.1.5.9

Puntuación CVSS

4.8Media

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Altos
Interacción del usuario: Requerida
Alcance: Cambiado
Confidencialidad: Bajo
Integridad: Bajo
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Todas las puntuaciones (2)

CISA-ADP	CVSS 3.1	4.8Media
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	4.8Media

EPSS (probabilidad de explotación en 30 días)

0.25%

superior al 16 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: poc
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2025-06-18
Publicada2025-07-10 09:00
Llegó a IP-DB2026-10-24 23:59
Última actualización2026-06-17 13:01

Asignada por (CNA): WPScan
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

6.4Media

CVE-2026-18742 hace 2 horas

Flatsome <= 3.20.12 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block

UX-themes Flatsome

The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block in all versions up to, and including, 3.20.12 due to insufficient input sanitization and output escap…

Sin puntuación

CVE-2026-126639 hace 4 horas

WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path

WP Ultimate CSV Importer; WP Ultimate CSV Importer Pro

The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name…

Sin puntuación

CVE-2026-126640 hace 4 horas

WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site o…

Sin puntuación

CVE-2026-126697 hace 4 horas

Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel

Quick Page/Post Redirect Plugin

The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which wa…

Sin puntuación

CVE-2026-118182 hace 4 horas

Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5…

Sin puntuación

CVE-2026-118183 hace 4 horas

Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create …