CVE-2026-14239

Deferred Deferred - Pending Action

Stored XSS in TourMaster WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: WPScan

Description

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-14239

EUVD

EUVD-2026-51014

Affected Vendors & Products

Vendor	Product	Version / Range
wp_tourmaster	tourmaster	to 5.4.8 (exc)
wpdevart	tourmaster	to 5.4.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability via Cross-Site Request Forgery (CSRF) in the Tourmaster WordPress plugin before version 5.4.8. The plugin fails to validate a nonce when saving a custom-filter label from a request parameter and does not escape the label when displaying it on the admin page. This allows an unauthenticated attacker to trick a logged-in administrator into saving malicious JavaScript code that executes in the WordPress admin area.

Detection Guidance

Check the installed version of the Tourmaster WordPress plugin. If it is below 5.4.8, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker could exploit this to inject malicious scripts into the WordPress admin area. This could lead to unauthorized actions being performed, data theft, or further compromise of the website or server. Administrators may unknowingly execute harmful code while managing the site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Stored XSS attacks can expose sensitive user data, resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the Tourmaster plugin to version 5.4.8 or later immediately. Remove any untrusted custom-filter labels that may contain malicious JavaScript. Review admin accounts for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-14239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70