CVE-2026-103480 in Tourfic Plugin
Summary
by MITRE • 10/16/2026
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on save does not strip the payload because angle-bracket characters are not required, allowing the unescaped attribute value to survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The Tourfic plugin for WordPress, which facilitates AI-powered travel booking, hotel reservations, and car rentals, contains a critical security flaw identified as Stored Cross-Site Scripting within versions up to 3.0.1. This vulnerability stems from insufficient input sanitization and output escaping mechanisms embedded in the application logic. Specifically, the defect resides in how the plugin handles the 'type' parameter during data submission processes. The core issue is that while some filtering is applied via the wp_kses_post function upon saving user inputs, this filter fails to adequately neutralize malicious payloads because it does not strictly require angle-bracket characters for execution. This oversight allows attackers to bypass standard HTML entity encoding protections by utilizing alternative syntaxes or event handlers that do not rely on traditional tag structures, thereby enabling the injection of arbitrary JavaScript code into stored data fields.
From a technical perspective, the vulnerability operates through a mechanism where unauthenticated users are exposed to malicious scripts injected by authenticated contributors. When an attacker with contributor-level access or higher submits a crafted payload via the 'type' parameter, the wp_kses_post filter processes the input but fails to strip the specific exploit code because it lacks angle brackets, which are typically flagged as dangerous in many sanitization routines. Consequently, the unescaped attribute value is persisted in the database and subsequently rendered on pages accessible by guest users or any visitor without authentication privileges. When these visitors load a page containing the injected content, their browsers execute the malicious script within the context of the vulnerable website's domain. This execution environment allows the attacker to perform actions such as stealing session cookies, hijacking user sessions, defacing websites, or redirecting victims to phishing sites, effectively compromising the integrity and confidentiality of the web application for all users interacting with the affected pages.
The operational impact of this vulnerability is significant due to its stored nature and low privilege requirement. Unlike reflected cross-site scripting which requires tricking a user into clicking a malicious link, stored XSS persists on the server side, meaning every visitor who views the compromised page becomes a potential victim without any additional interaction from the attacker beyond the initial injection. The ability for contributor-level users to exploit this flaw lowers the barrier for entry, as contributors are often trusted with content creation and may have broader access than basic subscribers or guests. This can lead to widespread compromise of user accounts if session tokens are stolen, potentially allowing attackers to escalate privileges further within the WordPress ecosystem. Furthermore, in a travel booking context where sensitive personal and financial data is processed, such an attack could facilitate identity theft or fraud by capturing credentials entered on subsequent pages after redirection.
To mitigate this vulnerability, immediate action should be taken by administrators of websites running Tourfic versions up to 3.0.1. The primary remediation step is to upgrade the plugin to version 3.0.2 or later, where the developers have addressed the input sanitization and output escaping deficiencies. Until an update can be applied, site owners should consider restricting contributor-level access to trusted individuals only and implementing a Web Application Firewall that can detect and block common XSS patterns, although this is not a substitute for patching the underlying code flaw. Additionally, enabling Content Security Policy headers can help mitigate the impact of successful exploitation by restricting the sources from which scripts are allowed to execute. From a development standpoint, future implementations must ensure comprehensive sanitization using WordPress standards like wp_kses_post with strict context-aware escaping and validate that all output is properly encoded before rendering in HTML attributes or event handlers to prevent similar bypasses involving non-angle-bracket payloads.
This vulnerability aligns with Common Weakness Enumeration CWE-79, which classifies Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. It also maps to the MITRE ATT&CK framework under techniques such as T1059 Command and Scripting Interpreter for executing arbitrary code via injected scripts and potentially T1204 User Execution if social engineering is used to target specific high-value accounts after initial compromise. Understanding these classifications helps in aligning security controls with industry best practices, ensuring that both preventive measures like input validation and detective controls like logging are robustly implemented to protect against evolving web application threats.