Stored Cross-Site Scripting in Tourfic – AI Powered Travel Booking Plugin

CVE-2026-103480

What is CVE-2026-103480?

The Tourfic plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) via the 'type' parameter. This vulnerability arises from inadequate input validation and output encoding, enabling authenticated users with contributor-level access or higher to insert malicious web scripts into web pages. Such scripts can execute unintended actions when a standard user visits the compromised page. The issue persists because the wp_kses_post filter, which is meant to sanitize input on save, fails to properly handle angle-bracket characters. Consequently, potentially harmful scripts can remain unescaped and execute as live event handlers for unauthenticated users.

References