CVE-2026-14239 — Tourmaster < 5.4.8 - Stored XSS via CSRF
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label whe…
Published: 2026-07-30 · CVSS: 7.1 · CVSS 3.1
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7