Tourfic Ai Powered Travel Booking Hotel Booking Car Rental
Monthly
Stored cross-site scripting in the Tourfic WordPress plugin (versions up to and including 3.0.1) allows attackers with subscriber-level or WooCommerce customer credentials to inject malicious JavaScript into comment content, which executes when victims view affected pages, REST API responses, or RSS feeds. Because WooCommerce customer registration is open without admin approval, any visitor can effectively become an attacker; the payload bypasses the plugin's own wp_kses_post() sanitization when served via the unauthenticated GET /wp-json/wp/v2/comments endpoint (content.rendered) and comment RSS feeds. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Tourfic - AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin affects all versions up to and including 3.0.1, allowing an authenticated attacker with contributor-level access or above to inject arbitrary web scripts via the 'type' parameter handled by the Wishlist shortcode. The injected payload is crafted without angle-bracket characters so it survives the wp_kses_post filter applied on save, and it then executes as a live event handler in the unauthenticated (guest) rendering branch whenever any visitor loads the affected page. Rated medium severity (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit code or CISA KEV entry was identified at time of analysis, and the practical risk is bounded by the requirement that a site grant the attacker contributor rights (for example through open registration or lax role assignment) and publish the injected content to guest-visible pages.
Stored cross-site scripting in the Tourfic WordPress plugin (versions up to and including 3.0.1) allows attackers with subscriber-level or WooCommerce customer credentials to inject malicious JavaScript into comment content, which executes when victims view affected pages, REST API responses, or RSS feeds. Because WooCommerce customer registration is open without admin approval, any visitor can effectively become an attacker; the payload bypasses the plugin's own wp_kses_post() sanitization when served via the unauthenticated GET /wp-json/wp/v2/comments endpoint (content.rendered) and comment RSS feeds. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Tourfic - AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin affects all versions up to and including 3.0.1, allowing an authenticated attacker with contributor-level access or above to inject arbitrary web scripts via the 'type' parameter handled by the Wishlist shortcode. The injected payload is crafted without angle-bracket characters so it survives the wp_kses_post filter applied on save, and it then executes as a live event handler in the unauthenticated (guest) rendering branch whenever any visitor loads the affected page. Rated medium severity (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit code or CISA KEV entry was identified at time of analysis, and the practical risk is bounded by the requirement that a site grant the attacker contributor rights (for example through open registration or lax role assignment) and publish the injected content to guest-visible pages.