CVE-2026-97470: Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfilteredhtml Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. While the plugin's own listing-page templates sanitize output with wpksespost(), the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds, exposing any headless client, feed reader, or third-party widget that renders comment content.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Any visitor who can register a WooCommerce customer account can exploit it, because the Customer role is freely self-registerable without administrator approval. WooCommerce must be active for this exposure path.
Are the plugin's normal listing pages affected by the stored script output?
The plugin's own listing-page templates sanitize output with wp_kses_post(). However, the stored comment payload is returned unsanitized by the unauthenticated WordPress comments REST endpoint and by post/comment RSS feeds.
Which consumers are most at risk of executing the stored payload?
Headless clients, feed readers, and third-party widgets that render comment content from the REST API or RSS feeds are exposed. Affected REST responses include GET /wp-json/wp/v2/comments with the payload in content.rendered.
How can I check whether content has been exposed through the affected interface?
Review comment data returned by the unauthenticated GET /wp-json/wp/v2/comments endpoint, specifically content.rendered, and review post/comment RSS feeds for unsafe comment markup or scripts. Also assess whether WooCommerce customer self-registration is enabled.