Tourmaster
Monthly
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
tourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, predictable file path inside its publicly accessible web directory, with no authentication or access control enforcing download restrictions. Any unauthenticated network attacker who knows or can derive the static export file URL can retrieve personally identifiable information - names, contact details, and booking records - after an administrator has triggered an export. A publicly available proof-of-concept exists per WPScan, and exploitation is fully automatable (SSVC), though EPSS sits at 0.14% and no CISA KEV listing exists at time of analysis.
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
Local File Inclusion in the GoodLayers Tourmaster WordPress plugin (versions <= 5.4.5) allows low-privileged authenticated users at the Subscriber level to include and read arbitrary local files from the server, exposing sensitive data such as configuration files and credentials. Reported through Patchstack and mapped to CWE-98, the flaw carries a CVSS 7.5 (High) score with high attack complexity; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
tourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, predictable file path inside its publicly accessible web directory, with no authentication or access control enforcing download restrictions. Any unauthenticated network attacker who knows or can derive the static export file URL can retrieve personally identifiable information - names, contact details, and booking records - after an administrator has triggered an export. A publicly available proof-of-concept exists per WPScan, and exploitation is fully automatable (SSVC), though EPSS sits at 0.14% and no CISA KEV listing exists at time of analysis.
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
Local File Inclusion in the GoodLayers Tourmaster WordPress plugin (versions <= 5.4.5) allows low-privileged authenticated users at the Subscriber level to include and read arbitrary local files from the server, exposing sensitive data such as configuration files and credentials. Reported through Patchstack and mapped to CWE-98, the flaw carries a CVSS 7.5 (High) score with high attack complexity; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.