---
id: "CVE-2026-103303"
page: "https://infrastack.ai/live/CVE-2026-103303"
kind: "vulnerability"
aliases: ["CVE-2026-103303"]
title: "Turisbook Booking System WordPress plugin: unauthenticated stored XSS against administrators"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "turisbook-booking-system", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-08T06:17:02+00:00"
first_seen_at: "2026-11-08T06:46:20+00:00"
updated_at: "2026-11-08T06:47:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103303", "first_seen_at": "2026-11-08T06:46:20+00:00"}]
exploit_sources: []
---

# Turisbook Booking System WordPress plugin: unauthenticated stored XSS against administrators

Link for people: https://infrastack.ai/live/CVE-2026-103303 (this .md is for agents)

The Turisbook Booking System WordPress plugin through 1.3.8 saves settings without authorisation or CSRF checks, and one saved setting is output unescaped on an admin page. An unauthenticated attacker can plant script that runs in an administrator's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Turisbook Booking System plugin is installed and its version is `1.3.8` or earlier in the WordPress Plugins screen or the plugin's main file header.

## Timeline

- 2026-11-08T06:46:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103303

## From the sources

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_