Tourmaster (Unknown) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-08-06. Vendor: Unknown.

CVEs of Tourmaster

• CVE-2026-14240 - CVSS 5.3 (medium), 2026-08-06: The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no…
• CVE-2026-14239 - CVSS 7.1 (high), 2026-07-30: The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not…
• CVE-2024-12400 - CVSS 7.1 (high), 2025-01-30: The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
• CVE-2024-11356 - CVSS 6.1 (medium), 2025-01-06: The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated…