high7.1
CVE-2026-14239
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not esc…
Impact
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).
Affected products
| Product | Affected versions |
|---|---|
| Tourmaster WordPress Plugin | before 5.4.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.