7.1
Élevée
CVE-2026-14239 The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken…
Description
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| tourmaster 5.4 | premières → < 5.4.8 | 5.4.8 |
Autres CVE de tourmaster
Les 4 CVE de tourmaster →
CVE-2026-14240
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its…
5.3
Moyenne
CVE-2024-12400
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes,…
7.1
Élevée
CVE-2024-11356
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the…
6.1
Moyenne