WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Hostel

Create your hostel, small hotel or BnB site with WordPress. Manage rooms, booking, unavailable dates, and more.

13Reported vulnerabilities
6.4Highest CVSS score
1.1.8Latest version
20+Active installs

What to do now

Update Hostel to 1.1.8 or later. 13 of these have a fixed version available. Updating resolves them.

Plugin last updated: March 12, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days
Affected versionsFixed inPublished
CVE-2025-6234 Medium 6.1 0.2% Before 1.1.5.8 1.1.5.8 July 10, 2025
CVE-2024-3753 Medium 5.9 0.8% Before 1.1.5.3 1.1.5.3 July 13, 2024
CVE-2023-0545 Medium 4.8 0.4% 1.1.5 and earlier 1.1.5.2 June 5, 2023
CVE-2025-6236 Medium 4.8 0.2% Before 1.1.5.9 1.1.5.9 July 10, 2025
CVE-2026-3907 Medium 6.4 0.4% 0 to 1.1.7 (inclusive) 1.1.8 July 10, 2026
CVE-2019-12345 Medium 6.1 1.2% Before 1.1.4 1.1.4 May 27, 2019
CVE-2026-1838 Medium 6.1 0.3% 0 to 1.1.6 (inclusive) 1.1.7 April 18, 2026
CVE-2025-66119 Medium 6.1 0.2% 1.1.5.9 and earlier 1.1.6 November 27, 2025
CVE-2025-31102 Medium 6.1 0.2% 1.1.5.5 and earlier 1.1.5.6 March 28, 2025
CVE-2025-30848 Medium 6.1 0.3% 1.1.5 and earlier 1.1.5.5 March 27, 2025
CVE-2025-39566 Medium 4.9 0.6% 1.1.5.6 and earlier 1.1.5.7 April 16, 2025
CVE-2024-4314 Medium 4.3 0.2% 0 to 1.1.5.3 (inclusive) 1.1.5.4 May 14, 2024
CVE-2023-32120 Medium 4.4 0.2% 1.1.5.1 and earlier 1.1.5.2 May 4, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.