Turisbook Booking System: Stored Cross-Site Scripting (CVE-2026-103303)
The Turisbook Booking System WordPress plugin through 1.3.8 lacks authorization and CSRF protections and fails to sanitize output, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
CVE search metadata
CVE search record: CVE-2026-103303. Severity: high. CVSS: 8.8. KEV: no. Product: Turisbook Booking System (<= 1.3.8). Brief: Turisbook Booking System: Stored Cross-Site Scripting (CVE-2026-103303). Brief link: https://feed.craftedsignal.io/briefs/2026-11-turisbook-xss/
Triage facts
Revision 1- Applicability
- Turisbook Booking System (<= 1.3.8)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 21:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Turisbook Booking System WordPress plugin, in versions through 1.3.8, does not have authorization and CSRF checks when saving settings. Additionally, the plugin does not sanitize or escape a setting before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.