EUVD-2026-51014
GHSA-w4cp-r668-c2ch
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attacker requires no privileges (PR:N) but must trick an admin (UI:R); XSS executes in admin browser context causing scope change (S:C) with limited CIA impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
AnalysisAI
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
Technical ContextAI
The tourmaster plugin (CPE: cpe:2.3:a:unknown:tourmaster:*:*:*:*:*:*:*:*) exposes an endpoint that stores a custom-filter label sourced directly from a user-supplied HTTP request parameter. Two distinct failures combine to create the vulnerability: first, the endpoint performs no CSRF nonce validation, so any cross-origin request from an attacker-controlled page can invoke it on behalf of an authenticated admin; second, the stored label is echoed back into the filter admin page without HTML escaping, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). The stored XSS then executes persistently inside the privileged WordPress admin context on every subsequent admin visit to the filter configuration page, not just at injection time. The CSRF is the delivery vector; the missing output encoding is the root cause of code execution.
RemediationAI
Update the tourmaster WordPress plugin to version 5.4.8 or later, which is the vendor-released patch addressing both the missing CSRF nonce check and the absent output escaping. Details are in the WPScan advisory at https://wpscan.com/vulnerability/1cd293c6-10c3-4a5c-914e-b3bdcd316d2b/. If immediate patching is not feasible, restrict access to the WordPress admin panel and the filter configuration endpoint via web server IP allowlisting, limiting who can trigger admin-side execution - this reduces CSRF attack surface but does not eliminate the underlying flaw and may disrupt legitimate remote administration. As a supplementary measure, deploy a WAF rule blocking script-tag patterns in the custom-filter label parameter, accepting that it will not reliably catch obfuscated payloads. Educate administrators about phishing and CSRF-delivery lures as a non-technical compensating control.
More in Tourmaster
View alltourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, pr
Local File Inclusion in the GoodLayers Tourmaster WordPress plugin (versions <= 5.4.5) allows low-privileged authenticat
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated at
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today