Live › vulnerability › CVE-2026-97470
Go to dashboardThe Tourfic WordPress plugin up to and including 3.0.1 does not sanitize comment content that is granted unfiltered HTML for the customer role. A logged-in customer, and any visitor who can self-register a WooCommerce customer account, can store scripts that run in the browsers of people who view the affected pages or feeds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Tourfic plugin at version 3.0.1 or earlier with WooCommerce active. The exposure is greater where customers can self-register, and where the comment REST endpoint, RSS feeds or headless clients render comment content. Sites that do not run Tourfic, or that have updated past 3.0.1, can skip it.
No product ranges from the sources yet.
wp plugin get tourfic --field=version; versions up to and including 3.0.1 are affected.wp plugin is-active woocommerce.3.0.1; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. While the plugin's own listing-page templates sanitize output with wp_kses_post(), the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds, exposing any headless client, feed reader, or third-party widget that renders comment content.
This page as .md · .json · in your agent: get_signal("CVE-2026-97470")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.