7.1
High
CVE-2026-14239 The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken…
Description
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| tourmaster 5.4 | earliest → < 5.4.8 | 5.4.8 |
Other CVEs of tourmaster
The 4 CVEs of tourmaster →
CVE-2026-14240
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its…
5.3
Medium
CVE-2024-12400
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes,…
7.1
High
CVE-2024-11356
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the…
6.1
Medium