CVE-2026-97470: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental

CVE-2026-97470 is a stored cross-site scripting vulnerability in the Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin. It arises from improper neutralization of input in comment content, specifically due to unfiltered HTML granted to the customer role. Authenticated attackers with subscriber-level access or higher can inject arbitrary scripts that execute when users access affected pages. WooCommerce activation is required, but because the customer role can be self-registered without admin approval, exploitation is possible by unauthenticated visitors. The plugin's listing-page templates sanitize output, but the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint and post/comment RSS feeds, exposing headless clients, feed readers, or third-party widgets that render comment content.

An attacker with subscriber-level access or higher can inject malicious scripts that execute in the context of users viewing the affected pages or consuming the REST API or RSS feeds. This can lead to theft of user credentials, session hijacking, or other client-side attacks. Because the customer role is self-registerable without admin approval, unauthenticated attackers can exploit this vulnerability by registering a WooCommerce account. The vulnerability affects confidentiality and integrity of user interactions but does not impact availability.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or disabling self-registration for the customer role or limiting comment submission privileges. Monitor vendor channels for updates and apply official patches once released.