Tour Booking Manager CVE-2026-109590

Requires an authenticated account with contributor-level privileges or above (PR:L) on a site where the Travelly / Tour Booking Manager plugin ≤2.3.6 is installed and the [ttbm-hotel-map] shortcode is usable. The attacker injects payloads through the 'width', 'height', or 'zoom' shortcode attributes, which are concatenated as raw values into double-quoted attributes of an <iframe> tag without sanitization or output escaping. Exploitation is limited by the need for a contributor-or-higher account (so single-admin sites and sites without open registration are largely insulated) and by the stored nature: the payload only fires when a user renders the injected page, though no explicit per-view user interaction beyond normal page viewing is required.

This is a moderate-severity, authenticated stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) in the Travelly / Tour Booking Manager WordPress plugin. The network vector with low complexity and no user interaction raises exposure, but PR:L is the key limiter: an attacker needs a valid contributor-level (or higher) account, which bounds this to multi-author sites or environments with open/weak registration. The scope change (S:C) reflects script execution in the browsers of other users, including potentially higher-privileged ones who view the injected page, which is the main escalation path. No EPSS score and no CISA KEV entry were supplied, and there is no public exploit reference in the input, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-urgent fix priority. Overall this is a genuine but second-tier issue: credible on multi-author WordPress sites, low real-world risk on single-admin deployments where contributor accounts do not exist.

An attacker holding a contributor-level account on a WordPress site running Travelly ≤2.3.6 creates or edits a page containing the [ttbm-hotel-map] shortcode and injects a JavaScript payload through the 'width', 'height', or 'zoom' attribute, which is concatenated unescaped into the <iframe> HTML. When an editor, administrator, or site visitor subsequently views that page, the script executes in their browser session. No public exploit code is referenced in the available data.