WordPress Plugin Vulnerabilities

Tourmaster < 5.3.5 - Reflected XSS

Description

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
tourmaster
Fixed in 5.3.5

References

CVE
CVE-2024-12400

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
3542315c-93c3-41dd-a99e-02a38cfd58fb

Timeline

Publicly Published
2025-01-09 (about 1 year ago)
Added
2025-01-09 (about 1 year ago)
Last Updated
2025-01-09 (about 1 year ago)

Other

Published
Title
Published
2022-03-02
Title
Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS
Published
2025-12-28
Title
Astra Widgets < 1.2.17 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2025-12-30
Title
teachPress <= 9.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-06-05
Title
Simple Google Static Map <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-01-16
Title
PDF Generator for WordPress < 1.1.2 - Reflected XSS