CVE-2026-103303

Summary

The Turisbook Booking System WordPress plugin (≤1.3.8) lacks authorization and CSRF protection for its settings save functionality, and fails to sanitize/escape one setting before rendering it in an admin page, enabling unauthenticated attackers to inject persistent XSS payloads that execute when administrators view the settings page.

Exploitability

Exploitation requires only sending a crafted HTTP POST request to the plugin's settings endpoint; no authentication or user interaction beyond the admin visiting the compromised settings page is needed.

Blast radius

Successful exploitation allows attackers to steal administrator session tokens, redirect admins to malicious sites, or perform privileged actions on their behalf, potentially leading to full site compromise.

Detection

Defenders should monitor WordPress admin access logs for POST requests to endpoints like /wp-admin/admin-ajax.php or plugin-specific settings endpoints (e.g., /wp-admin/admin.php?page=turisbook-settings) from unauthenticated IP addresses, especially those containing JavaScript payloads in form fields such as 'description' or 'custom_html'.

Prioritized remediation

Upgrade to Turisbook Booking System plugin version 1.3.9 or later, which includes authorization, CSRF protection, and proper output encoding for the affected setting.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.