CVE-2024-12400

The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

CVE-2024-12400

creationtimestamp| type| source ---|---|--- 2025-01-30 06:09:16+00:00| seen| https://infosec.exchange/users/cve/statuses/113915812673966819 2025-01-30 06:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgwthuotr42j 2025-01-30 07:11:29+00:00| seen|...

CVE-2024-12400 Tourmaster < 5.3.5 - Reflected XSS

The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

CVE-2024-12400

CVE-2024-12400 describes a reflected XSS in the Tour Master WordPress plugin prior to v5.3.5, caused by failing to escape generated URLs output in HTML attributes. The issue can be triggered by an attacker crafting a URL that injects malicious script, potentially affecting site visitors. Public d...

CVE-2024-12400 Tourmaster < 5.3.5 - Reflected XSS

The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...