Live › vulnerability › CVE-2026-109590
Go to dashboardThe Tour Booking Manager plugin for WordPress up to and including 2.3.6 does not sanitize the width, height and zoom attributes of the [ttbm-hotel-map] shortcode before writing them into an iframe tag. An authenticated contributor can store script in a page, and it runs for any visitor who opens that page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running Tour Booking Manager 2.3.6 or earlier where contributors or higher roles can create or edit pages that use the [ttbm-hotel-map] shortcode. Sites without this plugin, or where only trusted administrators write content, face much lower risk. Sites that do not use the shortcode are not exposed through this path.
No product ranges from the sources yet.
wp plugin get tour-booking-manager --field=version (slug assumed; unknown from sources)grep -R "ttbm-hotel-map" wp-content/ or a database search for [ttbm-hotel-map2.3.6 (the fixed version is unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · in your agent: get_signal("CVE-2026-109590")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.