Stored XSS Vulnerability in Tourfic Plugin for WordPress

CVE-2026-97470

What is CVE-2026-97470?

The Tourfic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers, including those with subscriber-level access, to inject malicious web scripts into comment content. The exploitation is facilitated as any unauthenticated visitor can easily register for a WooCommerce account, providing them the opportunity to exploit the vulnerability. Although outputs are sanitized in certain contexts, the stored payload can be delivered unsanitized through specific endpoints, exposing users to potential malicious scripts when accessing affected pages.

References