Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: GoodLayers Component: Tour Master Clear all filters
TI-2024-12411 CVE-2024-13369 · GHSA-94x8-gvq5-m85g

Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter

Priority LOW 39

The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the u…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00487 Published 2025-02-18 No fix listed CWE-89
TI-2024-11504 CVE-2024-12400 · GHSA-xr4j-2qp3-r4xc

Tourmaster < 5.3.5 - Reflected XSS

Priority MEDIUM 64

The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00285 Published 2025-01-30 Fixed in 5.3.5 CWE-79
TI-2024-10521 CVE-2024-11356 · GHSA-hj25-chfx-qmx5

Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking

Priority MEDIUM 60

The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00365 Published 2025-01-06 Fixed in 5.3.4 CWE-79