Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1838 The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 due to insu… https://www.cve.org/CVERecord?id=CVE-2026-1838
Post summary
The Hostel WordPress plugin is disclosed as vulnerable to Reflected XSS via the 'shortcode_id' parameter in all versions up to 1.1.6. No PoC, exploit, or patch details are mentioned.
CVE-2026-1838 Reflected Cross-Site Scripting in Hostel WordPress Plugin Versions Up To 1.1.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1838
Post summary
The post announces that CVE-2026-1838 is a Reflected Cross‑Site Scripting vulnerability affecting Hostel WordPress Plugin versions up to 1.1.6, with no proof‑of‑concept, exploit, or patch details provided.