{"id":"CVE-2026-103303","kind":"vulnerability","aliases":["CVE-2026-103303"],"related":[],"title":"Turisbook Booking System WordPress plugin: unauthenticated stored XSS against administrators","description":"The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.","summary":"The Turisbook Booking System WordPress plugin through 1.3.8 saves settings without authorisation or CSRF checks, and one saved setting is output unescaped on an admin page. An unauthenticated attacker can plant script that runs in an administrator's browser.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","turisbook-booking-system","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Turisbook Booking System plugin is installed and its version is `1.3.8` or earlier in the WordPress Plugins screen or the plugin's main file header.","fix":null,"status":"open","published_at":"2026-11-08T06:17:02+00:00","first_seen_at":"2026-11-08T06:46:20+00:00","triaged_at":"2026-11-08T06:47:29+00:00","updated_at":"2026-11-08T06:47:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Turisbook Booking System WordPress plugin: unauthenticated stored XSS against administrators","impact":"medium","summary":"The Turisbook Booking System WordPress plugin through 1.3.8 saves settings without authorisation or CSRF checks, and one saved setting is output unescaped on an admin page. An unauthenticated attacker can plant script that runs in an administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","turisbook-booking-system"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs script in administrator browsers, taking admin sessions","analyst_note":"Confirm the fixed version and any vendor advisory for Turisbook Booking System beyond 1.3.8 from the NVD entry and the WordPress plugin repository.","how_to_check":"- Check whether the Turisbook Booking System plugin is installed and its version is `1.3.8` or earlier in the WordPress Plugins screen or the plugin's main file header.\n- Unknown whether a later fixed version exists; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Turisbook Booking System WordPress plugin through version 1.3.8 are exposed, because its settings save handler lacks authorisation and CSRF checks. Administrators who open the plugin's admin pages are the ones who would run the injected script. Sites without this plugin, or running a later version than 1.3.8 if one exists, are not affected by this entry.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00076,"input_tokens":4555,"output_tokens":610,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103303':13A,16A '-2026':12A,15A '1.3.8':30B,69C 'admin':47B,95C 'administr':10A,59B,109C 'allow':97C 'attack':51B,107C 'authoris':34B,73C 'book':2A,20B,25B,64C 'browser':61B 'check':37B,76C 'cross':104C 'cross-sit':103C 'csrf':36B,75C 'cve':11A,14A 'escap':86C 'one':39B,87C 'output':43B,91C 'packag':17B 'page':48B,96C 'perform':101C 'plant':53B 'plugin':5A,28B,67C 'run':56B 'sanitis':84C 'save':31B,40B,78C 'script':54B,106C 'set':32B,41B,80C 'site':105C 'store':7A,102C 'system':3A,21B,26B,65C 'turisbook':1A,19B,24B,63C 'turisbook-booking-system':18B 'unauthent':6A,50B,98C 'unescap':44B 'user':99C 'without':33B 'wordpress':4A,22B,27B,66C 'xss':8A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Turisbook Booking System WordPress plugin through version 1.3.8 are exposed, because its settings save handler lacks authorisation and CSRF checks. Administrators who open the plugin's admin pages are the ones who would run the injected script. Sites without this plugin, or running a later version than 1.3.8 if one exists, are not affected by this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","turisbookbookingsystem","wordpress"],"campaign_type":null,"search_a":"'-103303':13A,16A '-2026':12A,15A 'administr':10A 'book':2A 'cve':11A,14A 'plugin':5A 'store':7A 'system':3A 'turisbook':1A 'unauthent':6A 'wordpress':4A 'xss':8A","search_b":"'1.3.8':30B 'admin':47B 'administr':59B 'attack':51B 'authoris':34B 'book':20B,25B 'browser':61B 'check':37B 'csrf':36B 'one':39B 'output':43B 'packag':17B 'page':48B 'plant':53B 'plugin':28B 'run':56B 'save':31B,40B 'script':54B 'set':32B,41B 'system':21B,26B 'turisbook':19B,24B 'turisbook-booking-system':18B 'unauthent':50B 'unescap':44B 'without':33B 'wordpress':22B,27B","search_c":"'1.3.8':69C 'admin':95C 'administr':109C 'allow':97C 'attack':107C 'authoris':73C 'book':64C 'check':76C 'cross':104C 'cross-sit':103C 'csrf':75C 'escap':86C 'one':87C 'output':91C 'page':96C 'perform':101C 'plugin':67C 'sanitis':84C 'save':78C 'script':106C 'set':80C 'site':105C 'store':102C 'system':65C 'turisbook':63C 'unauthent':98C 'user':99C 'wordpress':66C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103303","severity":null,"published_at":"2026-11-08T06:17:02+00:00","modified_at":"2026-11-08T06:17:02+00:00","first_seen_at":"2026-11-08T06:46:20+00:00","fetched_at":"2026-11-08T06:46:20+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}