CVE-2024-13369

CVE-2024-13369 affects the WordPress plugin Tour Master - Tour Booking, Travel, Hotel . It is a time-based SQL Injection via the parameter review_id in all versions up to 5.3.6. Exploitation requires authentication at Subscriber+ level and can be used to extract data from the database. The issue ...

CVE-2024-12400

CVE-2024-12400 describes a reflected XSS in the Tour Master WordPress plugin prior to v5.3.5, caused by failing to escape generated URLs output in HTML attributes. The issue can be triggered by an attacker crafting a URL that injects malicious script, potentially affecting site visitors. Public d...

CVE-2024-11356

CVE-2024-11356 affects the Tour Master - Tour Booking, Travel, Hotel WordPress plugin (versions prior to 5.3.4). The issue is an Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitization/escaping of parameters when rendered on pages, allowing unauthenticated users to inject scr...