Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-14240

Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tourmaster Wordpress
Products
Tourmaster Wordpress
CVE-2026-14239

Tourmaster < 5.4.8 - Stored XSS via CSRF

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tourmaster Wordpress
Products
Tourmaster Wordpress