The GoodLayers Goodlayers Hostel WordPress plugin includes a flaw that fails to neutralize user‑supplied input before rendering it in a web page. This improper input handling enables a reflected XSS vulnerability that can inject and execute arbitrary JavaScript code when a user views a crafted page or submits a malicious value. The impact is primarily confidentiality, integrity and availability of user sessions and data exposed through the application or browser. No direct disk or code execution on the server is described, but a compromised browser could session‑steal or perform further attacks.

WordPress sites that have the GoodLayers Goodlayers Hostel plugin installed at version 3.1.2 or earlier. The vendor, GoodLayers, publishes this plugin for the Goodlayers Hostel product line. Any affected site that has not updated beyond 3.1.2 is vulnerable.

The CVSS score of 7.1 indicates a high severity level for this XSS. EPSS of <1% suggests that active exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely need only lure a victim to a crafted URL or form input; typical exploitation requires no authentication or special permissions. Because the vulnerability is reflected, a remote attacker can exploit it by serving a malicious link or by forging a vulnerable request. The low EPSS value reflects narrow exploitation opportunities, but the impact and score still warrant promptly addressing the issue.