CVE-2026-103303: Stored XSS in Turisbook Booking System
A high-severity vulnerability has been published in the Turisbook Booking System WordPress plugin. Tracked as CVE-2026-103303 with a CVSS score of 8.8, it affects versions through 1.3.8.
The plugin has no authorisation or CSRF checks when saving its settings, and it does not sanitise and escape one of those settings before outputting it in an admin page. Unauthenticated users can store malicious script that runs when an administrator views the affected page.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-103303 |
| CVSS Score | 8.8 (High) |
| Affected Plugin | Turisbook Booking System (WordPress) |
| Affected Versions | 1.3.8 and earlier |
| Authentication Required | None |
| Impact | Stored cross-site scripting in an admin page |
| Published | 2026-11-08 |
Why This Matters
Script that executes in an administrator's browser can perform actions as that administrator, such as creating users or editing plugin and theme files. That makes stored XSS in an admin page a practical path to full site compromise.
Remediation
- Identify sites using Turisbook Booking System and confirm the version.
- Update when a fixed release is available. The NVD entry lists no patched version at the time of writing.
- Deactivate the plugin if it is not essential.
- Review the plugin's saved settings for unexpected HTML or script content.
- Apply a Content Security Policy to the admin area and use WAF rules to block unauthenticated writes to the plugin's settings endpoint.