CVE-2026-14239
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label from a request parameter, and does not escape that label when echoing it on the filter admin page. An unauthenticated attacker can trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored XSS via CSRF).
Risk Assessment
An administrator may unknowingly store malicious JavaScript that hijacks their session or performs other actions in the admin panel, potentially leading to full site compromise.
Recommendation
Update the tourmaster plugin to version 5.4.8 or later.
Other vulnerabilities in tourmaster WordPress plugin
Original NVD description (English source)
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).