Hostel

Hostel has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 13 are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 11 of the records (85%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection.

Every one of the 13 issues recorded for Hostel has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (2) reported by Bob Matyas. Hostel is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage100%
Open

0

Fixed

13

Get automatic notifications for all Hostel vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2019-12345

Hostel <= 1.1.3 - Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

13 records
Hostel banner
Latestv1.1.8

Hostel

Bob

Author

Bob

4.5(12)
90/100
Last Updated
2026-03-12 (6mo ago)
Active Installs
20+
Downloads
24,580
Requires WP
6.0+
Requires PHP
0+
Tested up to
WP 6.9.7
Created
2013-11-08 (13y ago)

Create your hostel, small hotel, or BnB site with WordPress. Hostel is online booking system with easy back-end management. You can publish the booking forms, room calendars, and room lists with shortcodes so the plugin fits any WordPress theme. Features Manage your booking mode: accept Paypal, manual payments, or don’t allow online booking Manage email notifications Manage rooms, beds, and prices Set unavailable dates when you are on vacations or just don’t want to accept guests in some rooms Manage bookings, process payments, contact customers List your rooms by using shortcodes Supports iCal / .ics to synchronize bookings with online systems. You can export and import bookings to/from all popular booking sites like Booking.com, AirBnB.com, Hotels.com etc. Localization / translation – ready Mobile / touch – friendly There are more and better features + premium support in the PRO version. Check it on our new site: wp-hostel.com Getting Started Go to Hostel link in your admin menu to manage your rooms and rates. Use the shortcodes to install a list of your rooms or to add the booking code to a post or page where you have described your rooms. Set up unavailable dates if you have such. Shortcodes [wphostel-list] will display a table with your available rooms. A date selector on the top lets the user choose dates of their visit and then the rooms list is updated. If you have enabled booking in your Hostel settings page, the table will also show “Book” button when appropriate. The button will automaically load the booking form. You can pass the attribute “max_days” to specify the maximum day interval that can be selected to show the table. [wphostel-booking] displays a generic booking form with a drop-down selector for choosing room, and a date selector. If you use the [wphostel-list] shortcode you most probably do not need this one because the booking form is automatically generated. For translating the plugin check the Help page under the Hostel menu in your administration. Community Translations The following translations are currently available. Please note they are maintained by volunteer translators and we can’t guarantee their accuracy. Spanish: wphostel-es_ES.mo | wphostel-es_ES.po

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C