CVE-2026-103303highCWE-79

CVE-2026-103303: high-severity vulnerability in Turisbook Booking System

Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting

Published

Follow this CVE+ Monitor Turisbook Booking System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 0.2%
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Turisbook Booking System
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.