Travelly Tour Travel Booking Manager For Woocommerce
Monthly
Authenticated WordPress users with Contributor-level access or higher can read the title, content, excerpt, taxonomies, and metadata of private, draft, and pending posts on sites running Travelly - Tour & Travel Booking Manager for WooCommerce through 2.3.6. The flaw is a CWE-862 missing authorization check in the plugin's duplicate-post action: a nonce with the static action 'TTBM_Admin.php' is not bound to a specific post, so a Contributor can reuse it against arbitrary post IDs. The assessed CVSS is 4.3 (low severity); no public exploit identified at time of analysis, and exploitation is gated by the Contributor-or-above account requirement, with the highest practical impact on multi-author sites that hold unpublished content from Administrators or Editors.
Stored cross-site scripting in the Travelly - Tour & Travel Booking Manager for WooCommerce WordPress plugin (Tour Booking Manager) through version 2.3.6 lets an authenticated attacker with contributor-level access or above inject arbitrary script into pages via the 'width', 'height' and 'zoom' attributes of the [ttbm-hotel-map] shortcode. The ttbm_hotel_map_shortcode() function concatenates raw attribute values into double-quoted attributes of an <iframe> tag, so payloads are persisted and execute when a user views the affected page. Scored CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw requires a contributor-or-higher account, which limits exposure on single-admin sites and those without open registration; no public exploit or active exploitation is reported, and the plugin repository shows an upstream code change (changeset 3757674) that has not been mapped to a confirmed patched release.
Authenticated WordPress users with Contributor-level access or higher can read the title, content, excerpt, taxonomies, and metadata of private, draft, and pending posts on sites running Travelly - Tour & Travel Booking Manager for WooCommerce through 2.3.6. The flaw is a CWE-862 missing authorization check in the plugin's duplicate-post action: a nonce with the static action 'TTBM_Admin.php' is not bound to a specific post, so a Contributor can reuse it against arbitrary post IDs. The assessed CVSS is 4.3 (low severity); no public exploit identified at time of analysis, and exploitation is gated by the Contributor-or-above account requirement, with the highest practical impact on multi-author sites that hold unpublished content from Administrators or Editors.
Stored cross-site scripting in the Travelly - Tour & Travel Booking Manager for WooCommerce WordPress plugin (Tour Booking Manager) through version 2.3.6 lets an authenticated attacker with contributor-level access or above inject arbitrary script into pages via the 'width', 'height' and 'zoom' attributes of the [ttbm-hotel-map] shortcode. The ttbm_hotel_map_shortcode() function concatenates raw attribute values into double-quoted attributes of an <iframe> tag, so payloads are persisted and execute when a user views the affected page. Scored CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw requires a contributor-or-higher account, which limits exposure on single-admin sites and those without open registration; no public exploit or active exploitation is reported, and the plugin repository shows an upstream code change (changeset 3757674) that has not been mapped to a confirmed patched release.