Tourmaster < 5.4.8 – Stored XSS via CSRF | CVE 2026-14239

Description

The plugin does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).

Proof of Concept

Prerequisites: Tourmaster active. The victim is an Administrator (the filter admin page requires the manage_tour_filter capability, granted only to administrators by default). No non-default configuration.

The attacker hosts a page that auto-navigates the logged-in admin's browser to (the option write has no nonce check):
https://victim.example/wp-admin/edit.php?post_type=tour&page=tourmaster_add_tour_filter_page&slug=xss_test_filter&label=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E

1. The admin opens the attacker's page; the GET fires with no nonce, so the label value <script>alert(document.domain)</script> is stored in wp_options (tourmaster_custom_tour_taxs) and the admin is redirected to the filter page.
2. The filter page renders the stored label unescaped, so the script executes in the administrator's session and persists for every administrator who later views the page.

Note: the working URL uses the edit.php?post_type=tour parent (the submenu is registered under the tour post-type parent; the bare admin.php?page=... form returns "Cannot load").