WordPress Plugin Vulnerabilities

Tourmaster < 5.3.5 - Reflected XSS

Description

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
tourmaster
Fixed in 5.3.5

References

CVE
CVE-2024-12400

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
3542315c-93c3-41dd-a99e-02a38cfd58fb

Timeline

Publicly Published
2025-01-09 (about 11 months ago)
Added
2025-01-09 (about 11 months ago)
Last Updated
2025-01-09 (about 11 months ago)

Other

Published
Title
Published
2024-06-24
Title
WP eStore < 8.5.5 - Reflected XSS in Category Editing
Published
2024-01-19
Title
Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting in New Chart
Published
2025-04-07
Title
Widgetize Pages Light <= 3.0 & Widgets as Shortcodes <= 5.9.10 - Reflected Cross-Site Scripting
Published
2025-06-19
Title
Scroll UP <= 2.0 - Reflected Cross-Site Scripting
Published
2025-01-24
Title
Plethora Plugins Tabs + Accordions < 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting