---
id: "CVE-2026-97470"
kind: "vulnerability"
aliases: ["CVE-2026-97470"]
title: "Tourfic WordPress plugin: stored XSS via comments lets customers inject scripts"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "tourfic", "woocommerce", "wordpress"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-16T14:19:27+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:59:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97470", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Tourfic WordPress plugin: stored XSS via comments lets customers inject scripts

The Tourfic WordPress plugin up to and including 3.0.1 does not sanitize comment content that is granted unfiltered HTML for the customer role. A logged-in customer, and any visitor who can self-register a WooCommerce customer account, can store scripts that run in the browsers of people who view the affected pages or feeds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Tourfic version in the WordPress plugins list or `wp plugin get tourfic --field=version`; versions up to and including `3.0.1` are affected.
- Check whether customer self-registration is enabled under Settings > General > Membership in WordPress.
- Check whether WooCommerce is active with `wp plugin is-active woocommerce`.

## Fix

- Update the Tourfic plugin to a version newer than `3.0.1`; the sources do not name the fixed version.
- Until updated, remove the unfiltered_html capability from the customer role or disable customer self-registration.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97470

## From the sources

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. While the plugin's own listing-page templates sanitize output with wp_kses_post(), the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds, exposing any headless client, feed reader, or third-party widget that renders comment content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_