CVE-2026-103303: Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting

Q: Who is exposed to this issue?

WordPress sites using the Turisbook Booking System plugin version 1.3.8 or earlier are exposed. The stored payload affects administrators when they view the relevant admin page.

Q: Does an attacker need an account or administrator interaction?

No attacker account is required because the affected settings can be saved without authorisation or CSRF checks. Exploitation still relies on an administrator later viewing the page where the unsanitised setting is output.

Q: How can I determine whether my site may be affected?

Check whether the Turisbook Booking System WordPress plugin is installed and whether its version is 1.3.8 or earlier. Review the cart background setting and relevant administrative pages for unexpected or suspicious saved content.

Published Nov 8, 2026

Updated

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using the Turisbook Booking System plugin version 1.3.8 or earlier are exposed. The stored payload affects administrators when they view the relevant admin page.

Does an attacker need an account or administrator interaction?

No attacker account is required because the affected settings can be saved without authorisation or CSRF checks. Exploitation still relies on an administrator later viewing the page where the unsanitised setting is output.

How can I determine whether my site may be affected?

Check whether the Turisbook Booking System WordPress plugin is installed and whether its version is 1.3.8 or earlier. Review the cart background setting and relevant administrative pages for unexpected or suspicious saved content.

CVE-2026-103303: Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does an attacker need an account or administrator interaction?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does an attacker need an account or administrator interaction?

How can I determine whether my site may be affected?