CVE-2026-14239
Tourmaster < 5.4.8 - Stored XSS via CSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
| Vendor | unknown |
| Product | tourmaster |
| Published | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown tourmaster
Be the first to know when new unknown vulnerabilities affecting unknown tourmaster are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / tourmaster
0 < 5.4.8
References
Credits
WPScan