Vendor
The Turisbook Booking System WordPress plugin through 1.3.8 lacks authorization and CSRF protections and fails to sanitize output, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.