CVE-2025-6236

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownHostel< 1.1.5.9

References

Timeline

Published
Jul 10, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-623608.8WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerabilityCVE-2025-623616.1WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerabiliCVE-2025-623626.9gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address oCVE-2025-623637.8yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to cCVE-2025-623646.2text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vuCVE-2025-623656.1LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` functCVE-2025-623662.9mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.30 contain CVE-2025-623674.8Taiga is an open source project management platform. In versions 6.8.3 and earlier, Taiga API is vulnerable to time-based blind SQL injectioCVE-2025-623689.0Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the TaigCVE-2025-623697.2Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code ECVE-2025-62379.8A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /aCVE-2025-623707.5Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input t