Tourmaster vulnerabilities
We track 2 vulnerabilities in Tourmaster products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 30, 2026.
2vulnerabilities
0critical
2high
0exploited
7.1average CVSS score
Latest Tourmaster vulnerabilities
- 7.1 High severity
tourmaster: Improper Neutralization of Input During Web Page Generation
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to tric
- 7.1 High severity
tourmaster: Improper Neutralization of Input During Web Page Generation
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.