CVE-2025-31102

WordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Mar 28, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.5.

Analysis

AI-generated

Technical impact

The vulnerability is an improper neutralization of input during web page generation that allows an attacker to inject malicious scripts into pages rendered by the Bob Hostel WordPress plugin. This reflected XSS flaw enables the execution of arbitrary JavaScript in the browsers of users who visit a crafted URL. Successful exploitation can lead to session hijacking, defacement, or the delivery of additional malware, compromising user confidentiality and data integrity.

Affected Systems

The issue affects the Bob Hostel WordPress plugin versions up to and including 1.1.5.5. Any WordPress site that has installed this plugin without updating to a newer release is vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation in the wild. The vulnerability is exploitable via a reflected XSS path that requires no authentication and can be triggered simply by a user accessing a malicious link. The plugin is not listed in CISA KEV.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Bob Hostel plugin to a version newer than 1.1.5.5, which contains the XSS fix.
  • If upgrading is not immediately possible, limit the plugin’s front‑end exposure so that only administrators can access its functionality.
  • Deploy site‑wide XSS protection such as a web application firewall or browser‑based security headers to mitigate the impact of reflected input until the plugin is updated.

Generated by OpenCVE AI on May 1, 2026 at 12:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8575 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel allows Reflected XSS. This issue affects Hostel: from n/a through 1.1.5.5.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel allows Reflected XSS. This issue affects Hostel: from n/a through 1.1.5.5. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.5.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel allows Reflected XSS. This issue affects Hostel: from n/a through 1.1.5.5.
Title WordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
Mar 26, 2025, 9:26 AM

View source JSON

Updated
Mar 28, 2025, 2:26 PM

JSON

Status
Deferred
Published
Mar 28, 2025, 10:15 AM
Modified
Jun 17, 2026, 9:09 AM

View source JSON

No data.

Updated
May 1, 2026, 12:45 PM

JSON