Plugin icon

Tourmaster

tourmaster

Vulnerabilities:

5

Last Updated:

April 4, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2025-05-21
Title
Tourmaster < 5.3.9 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 5.3.9
CVSS
9.8 (critical)
Published
2025-04-15
Title
Tourmaster < 5.4.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.4.1
CVSS
6.1 (medium)
Published
2025-02-17
Title
Tour Master - Tour Booking, Travel, Hotel < 5.3.8 - Authenticated (Subscriber+) SQL Injection via review_id Parameter
Fixed in
Fixed in 5.3.8
CVSS
6.5 (medium)
Published
2025-01-09
Title
Tourmaster < 5.3.5 - Reflected XSS
Fixed in
Fixed in 5.3.5
CVSS
7.1 (high)
Published
2024-12-16
Title
Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
Fixed in
Fixed in 5.3.4
CVSS
8.8 (high)