The Hostel plugin for WordPress accepts values for the "custom_currency" parameter and the "locale_url" setting without proper input validation or output escaping, allowing an authenticated user with Administrator privileges to persist arbitrary JavaScript code. This payload is stored in the plugin’s configuration and is rendered in the front‑end whenever visitors load pages that invoke the plugin, resulting in a stored Cross‑Site Scripting (XSS) vulnerability. The flaw leverages the WordPress Unfiltered HTML setting, which if disabled, removes the site‑wide sanitization that would otherwise mitigate such payloads. This is a classic CWE‑79 flaw, in which lack of sanitization leads to reflected or stored script execution. An attacker who can log in as an administrator could craft a malicious URL or form submission containing XSS content; once the payload is stored, any page that loads the affected settings will execute it in the victim’s browser. The impact is that if the malicious script runs in the context of a user accessing the site, the attacker can steal session cookies, deface the site, or perform other client‑side actions, potentially compromising the confidentiality and integrity of user data. The vulnerability is only exploitable on multisite WordPress installations or on single‑site installations that have unfiltered_html disabled and where the plugin is installed.

The affected product is the Hostel WordPress plugin by prasunsen. All versions up to and including 1.1.8 are vulnerable; any site running those versions, especially on WordPress multisite installations or sites with the unfiltered_html option turned off, is exposed. Future releases after 1.1.8 (such as 1.1.9 and later) are presumed to have remedied this issue, but sites still on 1.1.8 or earlier must upgrade.

The vulnerability carries a CVSS score of 4.4, indicating moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that known exploitation activity is not documented. The likely attack vector is through the WordPress administrative interface where the attacker is already authenticated with Administrator rights. An attacker with such access can use the plugin’s settings page to submit a malicious payload, which is then persisted and executed for all users who view affected pages, making the risk significant for sites that rely on the plugin for user‑interaction or payment processing.