CVE-2023-0545
Hostel < 1.1.5.2 - Admin+ Stored XSS
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled. This may be a duplicate of CVE-2023-32120.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-01-27 CVE Reserved
- 2023-05-10 CVE Published
- 2024-12-26 EPSS Updated
- 2025-01-08 CVE Updated
- 2025-01-08 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/b604afc8-61d0-4e98-8950-f3d29f9e9ee1 | 2025-01-08 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Kibokolabs Search vendor "Kibokolabs" | Hostel Search vendor "Kibokolabs" for product "Hostel" | <= 1.1.5 Search vendor "Kibokolabs" for product "Hostel" and version " <= 1.1.5" | wordpress |
Affected
| ||||||