Cpe:2.3:a:turisbook:booking_system:*:*:*:*:*:*:*:*

The Turisbook Booking System WordPress plugin through 1.3.8 lacks authorization and CSRF protections and fails to sanitize output, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.