PT-2026-66385 · Undefined · Undefined
CVE-2026-14239
·
Published
2026-07-30
·
Updated
2026-07-30
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined