CVE-2026-14239— Tourmaster < 5.4.8 - Stored XSS via CSRF
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | tourmaster | < 5.4.8 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14239
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tourmaster < 5.4.8 - Stored XSS via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Goodlayers Tour Master 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Goodlayers tour master是美国Goodlayers公司开源的一款旅行管理插件。 Goodlayers Tour Master 5.4.8之前版本存在安全漏洞，该漏洞源于未执行随机数检查且未转义自定义过滤器标签，可能导致未经身份验证的攻击者诱使管理员存储恶意JavaScript，造成存储型跨站脚本攻击（通过跨站请求伪造）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | tourmaster | 0 ~ 5.4.8 | - |
II. Public POCs for CVE-2026-14239
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14239
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14239 (1)
- 🔗 Tourmaster < 5.4.8 – Stored XSS via CSRF | CVE 2026-14239 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-30 · 36 CVEs total
| CVE-2026-13143 | WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN | |
| CVE-2026-15257 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modificatio | |
| CVE-2026-15240 | Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrat | |
| CVE-2026-15382 | Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Dele | |
| CVE-2026-11870 | Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Prote | |
| CVE-2026-11867 | Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/De | |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | |
| CVE-2026-11782 | Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Poin | |
| CVE-2026-12500 | WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update | |
| CVE-2026-15255 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR | |
| CVE-2026-13145 | WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR | |
| CVE-2026-13344 | Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table | |
| CVE-2026-13330 | Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-13345 | Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce | |
| CVE-2026-13178 | Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation | |
| CVE-2026-13395 | Bookly < 27.8 - Unauthenticated SQL Injection via staff_id | |
| CVE-2026-14310 | Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection | |
| CVE-2026-14305 | WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes | |
| CVE-2026-15235 | Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX | |
| CVE-2026-14188 | Easy Appointments <= 3.12.26 - Contributor+ Customer Data Disclosure |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: tourmaster
- CVE-2025-69133
WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion - CVE-2025-48292
WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion - CVE-2025-32923
WordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting ( - CVE-2024-12400
Tourmaster < 5.3.5 - Reflected XSS - CVE-2024-11356
Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Boo
Same vendor: Unknown
- CVE-2026-16565
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modif - CVE-2026-16572
LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' C - CVE-2026-16300
Chama < 1.0.13 - Unauthenticated Arbitrary User Password Res - CVE-2026-16563
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content D - CVE-2026-16564
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification
V. Comments for CVE-2026-14239
No comments yet