CVE-2026-103303
Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
| Vendor | unknown |
| Product | turisbook booking system |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown turisbook booking system
Be the first to know when new unknown vulnerabilities affecting unknown turisbook booking system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Turisbook Booking System
0 ≤ 1.3.8
References
Credits
Naiches WPScan