CVE-2026-28166

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

EUVD-2026-64795

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-28166

CVE-2026-28166 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Tourmaster plugin , affecting versions 5.4.9 and earlier . The CVSS 3.1 base score is 7.1 (HIGH) , with a network attack vector, low complexity, no required privileges, and a changed scope. CISA's SSVC ...

WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin TourMaster Plugin versions = 5.4.9...

PT-2026-80828

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

WordPress Tourmaster plugin < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export vulnerability

Unauthenticated Sensitive Data Disclosure via Order Export vulnerability discovered by WPscan in WordPress Plugin TourMaster Plugin versions 5.4.9...

WordPress tourmaster plugin < 5.4.8 - Stored XSS vulnerability

Stored XSS vulnerability discovered by ? in WordPress Plugin Tourmaster versions 5.4.8...

CVE-2026-14240

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14240 Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

EUVD-2026-53720

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14240

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14240

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14240 Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14240: Exposure of Sensitive Information to an Unauthorized Actor

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14239

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-14239

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...