CVE-2026-14239
N/A
N/A
Summary
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | tourmaster | 0 < 5.4.8 | affected |
Weaknesses
- CWE-79 Cross-Site Scripting (XSS)
- CWE-352 Cross-Site Request Forgery (CSRF)
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.