CyberRota Analysis
AI-GeneratedThe tourmaster WordPress plugin prior to version 5.4.8 is vulnerable due to a lack of nonce verification and insufficient escaping of user input, which allows unauthenticated attackers to inject malicious JavaScript into the admin area through stored Cross-Site Scripting (XSS) via CSRF. This can lead to unauthorized actions being executed within the admin interface, potentially compromising the integrity of the site. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).