PULSE
EN VIVO29señales / 24h
EN
FEED
ransomincransom reclama a sslf.local · US · Not Foundransomqilin reclama a TenSparrows · US · Not Foundransomcmdorganization reclama a Collge Mont Notre-Dame de Sherbrooke · CA · Educationransomqilin reclama a Db Tarimsal Enerji · TR · Agriculture and Food Productionransomcmdorganization reclama a Rondout Electric · US · Energy & Utilitiesransomqilin reclama a Byonyks · US · Technologyransomqilin reclama a Prenisac · US · Not Foundransomqilin reclama a Excel Consultores · MX · Professional Servicesransomqilin reclama a Affinity Capital · US · Financial Servicesransomkairos reclama a Warwick Fabrics · NZ · Manufacturingransomgunra reclama a Siam Stabilizers and Chemicals Co., Ltd. / SSC · TH · Manufacturingransomqilin reclama a Adpo · Otherransomqilin reclama a servitelco · CL · Technologyransomqilin reclama a Orimar · BE · Otherransomincransom reclama a sslf.local · US · Not Foundransomqilin reclama a TenSparrows · US · Not Foundransomcmdorganization reclama a Collge Mont Notre-Dame de Sherbrooke · CA · Educationransomqilin reclama a Db Tarimsal Enerji · TR · Agriculture and Food Productionransomcmdorganization reclama a Rondout Electric · US · Energy & Utilitiesransomqilin reclama a Byonyks · US · Technologyransomqilin reclama a Prenisac · US · Not Foundransomqilin reclama a Excel Consultores · MX · Professional Servicesransomqilin reclama a Affinity Capital · US · Financial Servicesransomkairos reclama a Warwick Fabrics · NZ · Manufacturingransomgunra reclama a Siam Stabilizers and Chemicals Co., Ltd. / SSC · TH · Manufacturingransomqilin reclama a Adpo · Otherransomqilin reclama a servitelco · CL · Technologyransomqilin reclama a Orimar · BE · Other
← Todos los CVEs
CVE Watch30 jul 2026

CVE-2026-14239

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request paramete

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 30 jul 2026 · Última mod.: 30 jul 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).

Referencias oficiales
CVEs relacionados

Sin CVEs relacionados por CWE o producto.