The GoodLayers Tourmaster plugin for WordPress versions prior to 5.4.1 contains a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that execute in the victim's browser when they interact with crafted URLs or inputs. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the plugin is not a cloud service, so remediation depends on the user applying updates once released.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS vector indicates that exploitation requires user interaction but no privileges or complex attack conditions. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of the GoodLayers Tourmaster plugin should monitor for official updates or patches from the vendor addressing this vulnerability and apply them promptly once available. Until a patch is released, consider limiting exposure by restricting access to affected functionality or employing web application firewall rules to detect and block reflected XSS attempts if feasible.