CVE-2024-3753

MEDIUMNuclei

Hostel < 1.1.5.3 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-3753 has a selected CVSS score of 5.9 (medium); EIP currently links 1 Nuclei template.

Description

The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 13, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Hostel

Default status: unaffected

CVE ListBefore 1.1.5.3affected

hostel

Browse kibokolabs / hostel

Default status: unknown

CVE ListBefore 1.1.5.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMHostel < 1.1.5.3 - Cross-Site ScriptingCVSS 5.9

The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Impact

Attackers can potentially exploit this XSS vulnerability to gain unauthorized access to sensitive information.

Remediation

Update the plugin to Latest version. Fixed in 1.1.5.3.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2024wpwordpresswp-pluginhostelxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CPE: cpe:2.3:a:kibokolabs:hostel:*:*:*:*:wordpress:*:*:*
Shodan: http.html:"/wp-content/plugins/hostel/"
FOFA: body="/wp-content/plugins/hostel"
https://wpscan.com/vulnerability/e140e109-4176-4b26-bf63-198262a31409/ https://nvd.nist.gov/vuln/detail/CVE-2024-3753

Source: ProjectDiscovery

References

2