4.8Orta

CVE-2025-6236Hostel < 1.1.5.9 - Admin+ Stored XSS

Hostel Yayım: 2025-07-10 09:00 (1 yıl önce)

Açıklama

The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
kibokolabs	hostel	< 1.1.5.9
—	Hostel	< 1.1.5.9

Kaynaklar ve yamalar

https://wpscan.com/vulnerability/ff4d312b-a4d1-40cd-a555-a0a1b46f9959/ exploitvdb-entrytechnical-descriptionExploit

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:kibokolabs:hostel:*:*:*:*:*:wordpress:*:* < 1.1.5.9

CVSS puanı

4.8Orta

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yüksek
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tüm puanlar (2)

CISA-ADP	CVSS 3.1	4.8Orta
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	4.8Orta

EPSS (30 günde istismar olasılığı)

0.25%

tüm CVE'lerin %16'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: poc
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2025-06-18
Yayımlandı2025-07-10 09:00
IP-DB'ye ulaştı2026-10-24 23:59
Son güncelleme2026-06-17 13:01

Numarayı veren (CNA): WPScan
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

6.4Orta

CVE-2026-18742 1 saat önce

Flatsome <= 3.20.12 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block

UX-themes Flatsome

The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block in all versions up to, and including, 3.20.12 due to insufficient input sanitization and output escap…

Puansız

CVE-2026-126639 4 saat önce

WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path

WP Ultimate CSV Importer; WP Ultimate CSV Importer Pro

The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name…

Puansız

CVE-2026-126640 4 saat önce

WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site o…

Puansız

CVE-2026-126697 4 saat önce

Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel

Quick Page/Post Redirect Plugin

The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which wa…

Puansız

CVE-2026-118182 4 saat önce

Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5…

Puansız

CVE-2026-118183 4 saat önce

Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create …