Vulnerabilities / Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin / WPSEC-2026-0806
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wishlist Shortcode 'type' Attribute
Medium 6.4
CWE-79Fixed in 3.0.2
- ID
- WPSEC-2026-0806
- Plugin
- Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental (tourfic)
- Affected
- from 2.1.0 before 3.0.2
- Remediation
- Update to 3.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The Tourfic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the wishlist shortcode in versions 2.1.0 to 3.0.1, due to insufficient input sanitization and output escaping on the attribute, which is placed unescaped into an HTML attribute of the wishlist markup shown to logged-out visitors. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a logged-out user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0806/
- https://plugins.svn.wordpress.org/tourfic/tags/3.0.2/
- https://wordpress.org/plugins/tourfic/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS