{"id":"CVE-2026-109590","kind":"vulnerability","aliases":["CVE-2026-109590"],"related":[],"title":"Tour Booking Manager WordPress plugin: stored XSS via hotel map shortcode","description":"The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Tour Booking Manager plugin for WordPress up to and including 2.3.6 does not sanitize the width, height and zoom attributes of the [ttbm-hotel-map] shortcode before writing them into an iframe tag. An authenticated contributor can store script in a page, and it runs for any visitor who opens that page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","tour-booking-manager","wordpress","wordpress-plugin"],"not_affected_if":["only-trusted-editors","plugin-not-installed","shortcode-unused"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get tour-booking-manager --field=version` (slug assumed; unknown from sources)\n- Search post content for the shortcode with `grep -R \"ttbm-hotel-map\" wp-content/` or a database search for `[ttbm-hotel-map`","fix":"- Update the Tour Booking Manager plugin to a version later than `2.3.6` (the fixed version is unknown from sources)\n- Until updated, review pages that contain the [ttbm-hotel-map] shortcode and remove any unexpected width, height or zoom values","status":"open","published_at":"2026-10-28T07:16:44+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","triaged_at":"2026-10-28T07:33:06+00:00","updated_at":"2026-10-28T07:33:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T07:33:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Tour Booking Manager plugin to a version later than `2.3.6` (the fixed version is unknown from sources)\n- Until updated, review pages that contain the [ttbm-hotel-map] shortcode and remove any unexpected width, height or zoom values","reach":"internet","title":"Tour Booking Manager WordPress plugin: stored XSS via hotel map shortcode","impact":"medium","summary":"The Tour Booking Manager plugin for WordPress up to and including 2.3.6 does not sanitize the width, height and zoom attributes of the [ttbm-hotel-map] shortcode before writing them into an iframe tag. An authenticated contributor can store script in a page, and it runs for any visitor who opens that page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","tour-booking-manager"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get tour-booking-manager --field=version` (slug assumed; unknown from sources)\n- Search post content for the shortcode with `grep -R \"ttbm-hotel-map\" wp-content/` or a database search for `[ttbm-hotel-map`","needs_analyst":false,"not_affected_if":["plugin-not-installed","shortcode-unused","only-trusted-editors"],"who_is_affected":"Sites running Tour Booking Manager 2.3.6 or earlier where contributors or higher roles can create or edit pages that use the [ttbm-hotel-map] shortcode. Sites without this plugin, or where only trusted administrators write content, face much lower risk. Sites that do not use the shortcode are not exposed through this path.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":3462,"output_tokens":677,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109590':14A,17A '-2026':13A,16A '2.3.6':38B,117C 'access':165C,181C 'arbitrari':170C 'attack':160C 'attribut':47B,103C,131C,143C,150C 'authent':63B,159C 'book':2A,21B,29B,83C 'concaten':140C 'contributor':64B,163C 'contributor-level':162C 'cross':93C 'cross-sit':92C 'cve':12A,15A 'doubl':147C 'double-quot':146C 'due':120C 'escap':127C 'execut':177C 'function':138C 'height':44B,99C 'hotel':9A,52B,108C,135C 'html':149C 'ifram':60B 'includ':37B,116C 'inject':169C,183C 'input':123C 'insuffici':122C 'level':164C 'make':155C 'manag':3A,22B,30B,84C 'map':10A,53B,109C,136C 'open':78B 'output':126C 'packag':18B 'page':70B,80B,174C,184C 'plugin':5A,26B,31B,85C 'possibl':157C 'quot':148C 'raw':142C 'run':73B 'sanit':41B,124C 'script':67B,95C,172C 'shortcod':11A,54B,102C,110C,137C 'site':94C 'store':6A,66B,91C 'suppli':130C 'tag':61B,153C 'tour':1A,20B,28B,82C 'tour-booking-manag':19B 'ttbm':51B,107C,134C 'ttbm-hotel-map':50B,106C 'user':129C,180C 'valu':144C 'version':112C 'via':8A,96C 'visitor':76B 'vulner':89C 'web':171C 'whenev':178C 'width':43B,98C 'wordpress':4A,23B,25B,33B,87C 'wordpress-plugin':24B 'write':56B 'xss':7A 'zoom':46B,101C","nicknames":[],"mitigations":[],"who_affected":"Sites running Tour Booking Manager 2.3.6 or earlier where contributors or higher roles can create or edit pages that use the [ttbm-hotel-map] shortcode. Sites without this plugin, or where only trusted administrators write content, face much lower risk. Sites that do not use the shortcode are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109590","severity":null,"published_at":"2026-10-28T07:16:44+00:00","modified_at":"2026-10-28T07:16:44+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","fetched_at":"2026-10-28T07:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}