CVE-2025-31102: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Bob Hostel plugin affecting versions through 1.1.5.5. The vulnerability was discovered and reported on March 25, 2025, and publicly disclosed on March 28, 2025. This security issue has been assigned CVE-2025-31102 and affects the WordPress Hostel plugin (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has received a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability can be exploited without authentication requirements (Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

Users are advised to update to version 1.1.5.6 or later to remove the vulnerability. While the security issue has been assessed as having a low severity impact and is unlikely to be exploited, updating is recommended as a security measure (Patchstack).