CVE-2026-109590 in Tour Booking Manager Plugin
Summary
by MITRE • 10/28/2026
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Tour Booking Manager plugin for WordPress contains a critical security vulnerability affecting versions up to and including 2.3.6. This flaw is classified as a Stored Cross-Site Scripting issue, which poses significant risks to the integrity of web applications relying on this software. The vulnerability resides within the ttbm_hotel_map_shortcode function, specifically triggered by the width, height, and zoom shortcode attributes associated with the [ttbm-hotel-map] shortcode. These parameters are intended for configuring map display dimensions but lack adequate security controls during processing.
The root cause of this vulnerability is insufficient input sanitization combined with a failure to apply output escaping on user-supplied attribute values. When the plugin processes these shortcodes, it directly concatenates the raw attribute inputs into double-quoted HTML attributes within an iframe tag without validating or encoding them first. This architectural oversight allows malicious actors to inject arbitrary JavaScript code that becomes embedded in the page source whenever a valid shortcode is rendered. Because the script is stored as part of the page content rather than being transient, it persists across multiple requests and user sessions until the vulnerable shortcode is removed or corrected by an administrator.
Exploitation of this vulnerability requires authenticated access with contributor-level permissions or higher within the WordPress environment. This relatively low privilege requirement makes the attack vector accessible to a broader range of potential threat actors compared to vulnerabilities requiring administrative rights. Once exploited, an attacker can craft malicious shortcodes that inject scripts into hotel map displays. When any user visits a page containing this compromised shortcode, the injected JavaScript executes in their browser context. This execution occurs within the same origin as the web application, granting the script full access to cookies, session tokens, and other sensitive data associated with the current user's login state.
The operational impact of this vulnerability extends beyond simple defacement or alert boxes. Attackers can leverage the executed scripts to perform actions on behalf of victims, such as stealing administrative credentials through cookie theft, redirecting users to phishing sites, or performing unauthorized transactions within the booking system. In environments where multiple contributors manage content, a single compromised account could lead to widespread dissemination of malicious code across numerous pages, affecting all visitors who view those pages. This represents a severe breach of confidentiality and integrity for both site administrators and end-users interacting with the tour booking platform.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves reflected or stored injection via HTML attributes without proper encoding. In terms of offensive security frameworks, this behavior corresponds to the ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution. It also relates to T1189, Drive-by Client-side Execution, as victims may be compromised simply by viewing affected pages without any direct interaction beyond loading them in a browser.
Mitigation strategies should prioritize immediate remediation through software updates. Administrators running versions up to and including 2.3.6 must upgrade to the latest patched version of the Tour Booking Manager plugin where input sanitization and output escaping have been properly implemented for all shortcode attributes. Until an update is applied, site administrators can implement a temporary workaround by restricting contributor-level access or disabling the [ttbm-hotel-map] shortcode entirely if it is not essential for current operations. Additionally, implementing a Web Application Firewall with rules designed to detect and block XSS payloads in POST requests containing shortcodes may provide an additional layer of defense against exploitation attempts while patching efforts are underway. Regular security audits and code reviews focusing on input validation practices should be conducted to prevent similar vulnerabilities from being introduced in future plugin updates or custom developments.