The tourmaster WordPress plugin versions prior to 5.4.8 contain a stored XSS vulnerability due to missing nonce verification and improper output escaping of a custom-filter label parameter. An attacker can exploit this by sending a crafted request that causes a logged-in administrator to store JavaScript code, which then executes in the admin interface, potentially compromising administrative functions.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser session. This can lead to administrative account compromise, data theft, or further attacks within the WordPress admin environment. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about unsolicited requests and consider restricting access to the admin interface. Monitoring for suspicious activity related to custom-filter labels may help detect exploitation attempts.