Read the docs

GoodLayers

Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

GoodLayers records in CISA KEV

No GoodLayers vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tour Master 3 records MEDIUM Goodlayers Core 2 records MEDIUM Good Learning Management System 1 record MEDIUM Travel Tour 1 record MEDIUM

Records

3 records in Tour Master · all components

TI-2024-11504 CVE-2024-12400 · GHSA-xr4j-2qp3-r4xc

Tourmaster < 5.3.5 - Reflected XSS

Priority MEDIUM 64

The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00285 Published 2025-01-30 Fixed in 5.3.5 CWE-79
TI-2024-10521 CVE-2024-11356 · GHSA-hj25-chfx-qmx5

Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking

Priority MEDIUM 60

The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00365 Published 2025-01-06 Fixed in 5.3.4 CWE-79
TI-2024-12411 CVE-2024-13369 · GHSA-94x8-gvq5-m85g

Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter

Priority LOW 39

The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the u…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00487 Published 2025-02-18 No fix listed CWE-89
Open these records in search →