CVE-2024-3753

MEDIUM NUCLEI

Kibokolabs Hostel < 1.1.5.3 - XSS

Title source: rule

Description

The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Nuclei Templates (1)

Hostel < 1.1.5.3 - Cross-Site Scripting

MEDIUMby ritikchaddha

Shodan: http.html:"/wp-content/plugins/hostel/"

FOFA: body="/wp-content/plugins/hostel"

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/e140e109-4176-4b26-bf63-198262a31409/

Scores

CVSS v3 5.9

EPSS 0.0146

EPSS Percentile 80.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Details

CWE

CWE-79

Status published

Products (1)

kibokolabs/hostel < 1.1.5.3

Published Jul 13, 2024

Tracked Since Feb 18, 2026