{"id":"CVE-2026-103303","published":"2026-11-08T06:17:02.487","lastModified":"2026-11-10T16:28:46.510","description":"The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/10693b34-ab03-4c24-bd9d-5a2efbfdbeb2/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Turisbook Booking System WordPress plugin (≤1.3.8) lacks authorization and CSRF protection for its settings save functionality, and fails to sanitize/escape one setting before rendering it in an admin page, enabling unauthenticated attackers to inject persistent XSS payloads that execute when administrators view the settings page.","exploitability":"Exploitation requires only sending a crafted HTTP POST request to the plugin's settings endpoint; no authentication or user interaction beyond the admin visiting the compromised settings page is needed.","blast_radius":"Successful exploitation allows attackers to steal administrator session tokens, redirect admins to malicious sites, or perform privileged actions on their behalf, potentially leading to full site compromise.","remediation":"Upgrade to Turisbook Booking System plugin version 1.3.9 or later, which includes authorization, CSRF protection, and proper output encoding for the affected setting.","detection":"Defenders should monitor WordPress admin access logs for POST requests to endpoints like /wp-admin/admin-ajax.php or plugin-specific settings endpoints (e.g., /wp-admin/admin.php?page=turisbook-settings) from unauthenticated IP addresses, especially those containing JavaScript payloads in form fields such as 'description' or 'custom_html'.","tags":["xss","csrf","auth-bypass","web","wordpress"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:45:43.149Z"}}