CVE-2026-103480

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on save does not strip the payload because angle-bracket characters are not required, allowing the unescaped attribute value to survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.

• CWE-79

• https://downloads.wordpress.org/plugin/tourfic.3.0.2.zip
• https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L19
• https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L25
• https://www.wordfence.com/threat-intel/vulnerabilities/id/34466168-c03c-430e-9aba-daf718cbc9ad?source=cve

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103472restbed through 5.0.0 accepts WebSocket frames with declared…7.5
• CVE-2026-103473Deno versions 2.7.0 through 2.9.7 on Windows contain a comma…8.1
• CVE-2026-103474yii2-starter-kit through 4.2.0 fails to validate file types …8.8
• CVE-2026-103475yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii…9.1
• CVE-2026-103476yii2-starter-kit through 4.2.0 fails to validate article pub…5.3
• CVE-2026-103478The Premium Packages – Sell Digital Products Securely plugin…6.4
• CVE-2026-103481The Gwolle Guestbook plugin for WordPress is vulnerable to R…6.1
• CVE-2026-103482The Simple Newsletter Plugin – Noptin plugin for WordPress i…5.4
• CVE-2026-103484IVFFlat index build in pgvector before 0.8.7 allows a databa…8.8
• CVE-2026-103485The Extensions for Leaflet Map plugin for WordPress is vulne…5.4
• CVE-2026-103488In JetBrains YouTrack before 2026.2.19422 missing authorisat…7.1
• CVE-2026-103489In JetBrains YouTrack before 2026.2.19422 hTML injection in …5.4