Bob Hostel vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Latest Bob Hostel vulnerabilities

CVE-2026-1645 — Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting (CVSS 4.4)
CVE-2026-3907 — Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode (CVSS 6.4)
CVE-2026-1838 — Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter (CVSS 6.1)
CVE-2023-32120 — WordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS) (CVSS 5.9)
CVE-2025-66119 — WordPress Hostel plugin <= 1.1.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2025-6236 — Hostel < 1.1.5.9 - Admin+ Stored XSS (CVSS 4.8)
CVE-2025-6234 — Hostel < 1.1.5.8 - Reflected XSS (CVSS 6.1)
CVE-2025-39566 — WordPress Hostel plugin <= 1.1.5.6 - SQL Injection Vulnerability (CVSS 7.6)
CVE-2025-30848 — WordPress Hostel plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2025-31102 — WordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2024-3753 — Hostel < 1.1.5.3 - Reflected XSS (CVSS 5.9)
CVE-2024-4314 — hostel <= 1.1.5.3 - Cross-Site Request Forgery (CVSS 4.3)
CVE-2023-0545 — Hostel < 1.1.5.2 - Admin+ Stored XSS (CVSS 4.8)
CVE-2019-12345 — (CVSS 6.1)