The Hostel WordPress plugin suffers from a reflected Cross‑Site Scripting flaw caused by insufficient input sanitization and output escaping for the 'shortcode_id' parameter. An attacker can craft a link containing malicious JavaScript that is reflected back to the victim’s browser when the link is clicked, allowing the execution of arbitrary client‑side code. This can lead to session hijacking, credential theft, or malicious page manipulation for the user.

WordPress sites running the Hostel plugin at any version up to and including 1.1.6 are affected. The flaw was present in all releases prior to the available 1.1.7 update, which appears to correct the sanitization issue.

The CVSS score of 6.1 indicates a moderate severity. Because the flaw is remote and unauthenticated, an attacker only needs to convince a user to click a specially crafted URL; no credentials or local execution is required. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that exploitation may be limited to targeted or opportunistic attacks rather than widespread automated exploitation.