Stored Cross-Site Scripting in Tourmaster WordPress Plugin
CVE-2026-14239
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14239?
The Tourmaster WordPress plugin prior to version 5.4.8 is vulnerable due to inadequate nonce checks when saving a custom-filter label from user input. This weakness allows unauthenticated attackers to exploit it and potentially inject malicious JavaScript. If a logged-in administrator is tricked into saving this label, the injected script can execute within the admin area, leading to significant security risks, including unauthorized actions and data manipulation on the website.
Affected Version(s)
tourmaster 0 < 5.4.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.