CVE-2026-103480: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental

CVE-2026-103480 is a stored cross-site scripting vulnerability in the Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin. The flaw exists in all versions up to and including 3.0.1 due to improper neutralization of input during web page generation. Specifically, the 'type' parameter is not properly sanitized or escaped, allowing authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript code. The wp_kses_post filter does not remove the payload because it does not require angle brackets, enabling the malicious script to survive storage and execute as a live event handler when the page is rendered to unauthenticated users.

An attacker with contributor-level access can inject persistent malicious scripts into pages via the 'type' parameter. These scripts execute in the context of any user who views the infected page, potentially leading to theft of session cookies, unauthorized actions, or other client-side impacts. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently documented. Users should upgrade beyond version 3.0.1 if a fixed version becomes available. Until then, restrict contributor-level access to trusted users only. Monitor vendor advisories for updates. Implementing additional input validation or output escaping on the 'type' parameter may mitigate risk, but official remediation guidance should be followed once published.