Filtered by vendor Tourmaster
Subscriptions
Filtered by product Tourmaster
Subscriptions
Total
1 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14239 | 2 Tourmaster, Wordpress | 2 Tourmaster, Wordpress | 2026-07-30 | N/A |
| The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF). | ||||
Page 1 of 1.