CVE-2026-103303 · Package
NO FIX YET
The Turisbook Booking System WordPress plugin through 1.3.8 saves settings without authorisation or CSRF checks, and one saved setting is output unescaped on an admin page. An unauthenticated attacker can plant script that runs in an administrator's browser.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Turisbook Booking System WordPress plugin through version 1.3.8 are exposed, because its settings save handler lacks authorisation and CSRF checks. Administrators who open the plugin's admin pages are the ones who would run the injected script. Sites without this plugin, or running a later version than 1.3.8 if one exists, are not affected by this entry.
Not affected if plugin-not-installed
Who cares turisbook-booking-system, wordpress
1.3.8 or earlier in the WordPress Plugins screen or the plugin's main file header.No fix yet, per the sources.
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.