medium · CVSS v3 6.1

CVE-2026-103303

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its …

Description

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

Scores

Severity
medium
CVSS v2
4.3
CVSS v3
6.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-97194

The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

View analysis

medium

CVE-2026-124326

A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

View analysis

medium

CVE-2026-123567

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ properties via devalue.parse and devalue.unflatten. This can alter object prototypes when merged with Object.assign, potentially changing application behavior. The flaw is exploitable in any code that uses devalue to deserialize data.

View analysis

medium

CVE-2026-123568

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.

View analysis