Vulnerability in Tourmaster

CVE-2026-14239

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthentic…

Affected products

  • Unknown Tourmaster — versions 0

References