CVE-2026-103303
Received Received - Intake

Stored XSS in Turisbook Booking System WordPress Plugin

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: WPScan

Description
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-103303
EUVD
EUVD-2026-119469

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Turisbook Booking System From 0 (inc) to 1.3.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Turisbook Booking System WordPress plugin through version 1.3.8 has a vulnerability due to missing authorization and CSRF checks when saving settings. It also fails to sanitize and escape user input before displaying it in an admin page. This allows unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

Detection Guidance

Check if the Turisbook Booking System WordPress plugin version 1.3.8 or below is installed. Inspect admin pages for unexpected scripts or unusual input handling. Review server logs for unauthorized POST requests to plugin settings endpoints.

Impact Analysis

Unauthenticated attackers can inject malicious scripts into the plugin's settings. When an administrator views the affected page, the injected scripts execute, potentially leading to unauthorized actions, data theft, or further compromise of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. It may result in legal penalties, reputational damage, and loss of trust due to compromised user data.

Mitigation Strategies

Update the Turisbook Booking System plugin to the latest version immediately. Disable the plugin if no update is available. Implement strict input validation and output escaping in WordPress configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...