{
 "id": "WPSEC-2026-0806",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0806/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0806/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0806/index.md",
 "title": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wishlist Shortcode 'type' Attribute",
 "description": "The Tourfic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the wishlist shortcode in versions 2.1.0 to 3.0.1, due to insufficient input sanitization and output escaping on the attribute, which is placed unescaped into an HTML attribute of the wishlist markup shown to logged-out visitors. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a logged-out user accesses an injected page.",
 "plugin": {
  "slug": "tourfic",
  "name": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin",
  "full_name": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental",
  "wordpress_org": "https://wordpress.org/plugins/tourfic/",
  "advisories_url": "https://wpsec.com/vuln/plugin/tourfic/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/tourfic"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.0",
    "from_inclusive": true,
    "to": "3.0.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.0 before 3.0.2"
  ]
 },
 "introduced_in": "2.1.0",
 "fixed_in": "3.0.2",
 "remediation": "Update to 3.0.2 or later.",
 "fix_released": "2026-10-11T16:18:20+00:00",
 "published": "2026-10-12T19:07:11+00:00",
 "updated": "2026-10-12T11:06:47.266783+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0806/",
  "https://plugins.svn.wordpress.org/tourfic/tags/3.0.2/",
  "https://wordpress.org/plugins/tourfic/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/tourfic",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}