CVE-2024-12400

CVE-2024-12400 is a reflected cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting the Tourmaster WordPress plugin in versions before 5.3.5. The flaw occurs because the plugin does not properly escape generated URLs before outputting them in HTML attributes, allowing attackers to inject malicious scripts that execute in the context of a victim's browser.

An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low attack complexity (AC:L), but it requires user interaction (UI:R), such as clicking a malicious link. Exploitation results in reflected XSS with a changed scope (S:C), enabling limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 base score of 7.1. This could allow theft of session cookies or other client-side data.

WPScan advisories, referenced at https://wpscan.com/vulnerability/3542315c-93c3-41dd-a99e-02a38cfd58fb/, detail the issue and recommend updating the Tourmaster plugin to version 5.3.5 or later as the primary mitigation.