Description

Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-24T12:16:50.723Z",
  "pubdate": "2026-08-24T12:16:50.723Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the Tourmaster plugin affecting versions 5.4.9 and prior. This security flaw allows unauthenticated remote threat actors to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the application and viewed by unsuspecting users. The primary impact of this vulnerability includes session hijacking, unauthorized actions performed on behalf of authenticated users, defacement of the web interface, and the potential redirection of victims to malicious external destinations. The affected systems encompass any WordPress deployment utilizing the vulnerable Tourmaster product within the specified version range. The risk implications are severe for organizations relying on this software, as exploitation requires no prior authentication, low complexity, and can be executed entirely over the network via standard HTTP requests. No special privileges are required by the attacker to initiate the malicious sequence, lowering the barrier to entry for potential exploitation. Mitigation necessitates applying vendor-supplied updates or patches when available, implementing strict input sanitization, and deploying robust output encoding mechanisms to neutralize untrusted parameters before DOM rendering.",
  "technicalDetails": "The vulnerability stems from insufficient validation and output encoding of user-supplied parameters handled by the Tourmaster plugin in versions 5.4.9 and prior. Specifically, the vulnerable component fails to adequately sanitize input data received via HTTP requests before reflecting it back within the Document Object Model (DOM) of the response pages. This lack of context-aware output encoding allows an attacker to inject arbitrary HTML markup and executable JavaScript payloads into application parameters without requiring authentication or prior system access.\nThe attack flow begins when an unauthenticated adversary crafts a malicious URL or HTTP request containing an embedded JavaScript payload within vulnerable input vectors processed by the Tourmaster plugin. The attacker then induces a target user—such as an authenticated administrator or standard user—to interact with the malicious link, often via phishing campaigns or poisoned hyperlinks. Upon processing the request, the web application incorporates the malicious payload directly into the HTTP response without proper sanitization or neutralization.\nWhen the victim's browser renders the response, the injected script executes within the security context of the victim's active session. Because the execution occurs in the client-side environment, the malicious payload inherits the privileges of the victim, granting the attacker the ability to access sensitive session cookies, manipulate DOM elements, capture keystrokes, or perform unauthorized administrative actions via Asynchronous JavaScript and XML (AJAX) requests.\nThe network exposure for this vulnerability is external, as the application endpoints handling the vulnerable parameters are typically accessible over the public internet. The exploitation requirements are minimal, demanding only network connectivity to the target web server and a mechanism to deliver the crafted payload to a victim. The root cause is a failure in secure coding practices regarding input handling and output rendering, specifically the absence of robust contextual output encoding within the affected Tourmaster functions."
}