Tourfic WordPress Plugin CVE-2026-103480

Requires an authenticated WordPress account at contributor level or above (PR:L), so the site must grant untrusted users contributor access or permit contributor/open registration - the primary limiting factor. The specific vector is the 'type' parameter handled by the Tourfic Wishlist shortcode (Wishlist.php). The payload must be crafted as an attribute value/event handler without angle-bracket characters so it passes the wp_kses_post sanitization applied on save; it then executes in the unauthenticated (guest) rendering branch when any visitor accesses the injected page. Realistic impact therefore depends on the site exposing pages that render the stored shortcode to guests and on the attacker already possessing or obtaining contributor rights.

This is a medium-severity (CVSS 6.4) stored XSS that should be treated as a moderate, not top-tier, priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity injection with a scope change - the payload crosses a trust boundary by storing as an authenticated contributor and firing in the unauthenticated guest rendering branch. The key risk-limiting signal is PR:L: exploitation requires a contributor-level account, so real-world risk is concentrated on multi-author sites or those allowing open/contributor registration, not on single-admin installs. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public exploit (POC) is indicated - so there is no evidence of active or widespread exploitation. The CVSS claims UI:N, but stored XSS inherently requires a victim to load the injected page; this is a known Wordfence scoring convention rather than a contradiction, though defenders should note the de facto dependency on victim page visits. Overall: a legitimate issue to patch, but the contributor-access prerequisite and absence of KEV/POC/EPSS signals place it below internet-facing unauthenticated RCE-class priorities.

An attacker who holds (or registers for) a contributor-level account on a Tourfic-enabled WordPress site submits content containing a malicious value in the 'type' parameter of the Wishlist shortcode, crafting the payload as an HTML attribute/event handler that needs no angle brackets so it survives the wp_kses_post filter. The stored payload then executes in the browser of any guest visitor who loads the affected page, enabling session/cookie theft, forced actions, or redirection. No public exploit code is identified at time of analysis, so weaponization would require an attacker to reconstruct the attribute-injection technique from the advisory.