What is the CVSS score of CVE-2026-14239?

CVE-2026-14239 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of tourmaster Plugin are affected by CVE-2026-14239?

The tourmaster WordPress plugin (versions prior to 5.4.8) contains a vulnerability that could allow attackers to compromise WordPress administrator accounts by injecting persistent malicious scripts…. A patch is available.

Is there a public PoC exploit available for CVE-2026-14239?

Yes, a public proof-of-concept exploit is available for CVE-2026-14239. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14239?

Within 24 hours: identify all WordPress installations using tourmaster plugin versions below 5.4.8 and alert administrators to exercise caution with suspicious links while monitoring accounts for unusual activity. Within 7 days: deploy tourmaster version 5.4.8 or later across all affected WordPress installations through standard plugin update mechanisms or staged rollout procedures. Within 30 days: verify complete patch deployment across all systems, implement automated vulnerability scanning for WordPress plugins, and conduct security awareness training on CSRF and social engineering attack vectors.

tourmaster Plugin CVE-2026-14239

EUVD-2026-51014 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 WPScan

GHSA-w4cp-r668-c2ch

WordPress XSS CSRF Tourmaster Unknown

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Attacker requires no privileges (PR:N) but must trick an admin (UI:R); XSS executes in admin browser context causing scope change (S:C) with limited CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:29 vuln.today

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

HIGH 7.1

DescriptionCVE.org

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).

AnalysisAI

Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.

Technical ContextAI

The tourmaster plugin (CPE: cpe:2.3:a:unknown:tourmaster:*:*:*:*:*:*:*:*) exposes an endpoint that stores a custom-filter label sourced directly from a user-supplied HTTP request parameter. Two distinct failures combine to create the vulnerability: first, the endpoint performs no CSRF nonce validation, so any cross-origin request from an attacker-controlled page can invoke it on behalf of an authenticated admin; second, the stored label is echoed back into the filter admin page without HTML escaping, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). The stored XSS then executes persistently inside the privileged WordPress admin context on every subsequent admin visit to the filter configuration page, not just at injection time. The CSRF is the delivery vector; the missing output encoding is the root cause of code execution.

RemediationAI

Update the tourmaster WordPress plugin to version 5.4.8 or later, which is the vendor-released patch addressing both the missing CSRF nonce check and the absent output escaping. Details are in the WPScan advisory at https://wpscan.com/vulnerability/1cd293c6-10c3-4a5c-914e-b3bdcd316d2b/. If immediate patching is not feasible, restrict access to the WordPress admin panel and the filter configuration endpoint via web server IP allowlisting, limiting who can trigger admin-side execution - this reduces CSRF attack surface but does not eliminate the underlying flaw and may disrupt legitimate remote administration. As a supplementary measure, deploy a WAF rule blocking script-tag patterns in the custom-filter label parameter, accepting that it will not reliably catch obfuscated payloads. Educate administrators about phishing and CSRF-delivery lures as a non-technical compensating control.