CVE-2026-103303
Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
What each source reports
CVE List No score
Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
- Record
CVE-2026-103303- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-3hhc-3pgw-rhv3 No score
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF...
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
- Record
GHSA-3hhc-3pgw-rhv3- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103303 is a vulnerability with no CVSS score yet in Unknown Turisbook Booking System, published November 8, 2026. No source lists public exploit code. No source names a fixed version.