CVE-2026-14239CWE-352CWE-79cross-site-scriptingcsrf
CVE-2026-14239
High · published July 30, 2026
What it is
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
The record
Technical detail
- CVSS v3.1
- 7.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00144 · 3.3th percentile
- Weaknesses
- CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-07-30T10:25Z
References (1)
EPSS history
Timeline