6.1
Medium
CVE-2024-11356 The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the…
Description
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| tourmaster 5.3 | earliest → < 5.3.4 | 5.3.4 |
Other CVEs of tourmaster
The 4 CVEs of tourmaster →
CVE-2026-14240
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its…
5.3
Medium
CVE-2026-14239
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken…
7.1
High
CVE-2024-12400
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes,…
7.1
High