{"vulnerability": "CVE-2026-97470", "sightings": [{"uuid": "ae848e82-f833-4a3c-b940-092ff3e8a456", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-97470", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117450858293754420", "content": "CVE-2026-97470 Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role The Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. While the plugin's own listing-page templates sanitize output with wp_kses_post(), the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds, exposing any headless client, feed reader, or third-party widget that renders comment content.\nhttps://www.cve.org/CVERecord?id=CVE-2026-97470https://www.wordfence.com/threat-intel/vulnerabilities/id/468451f8-699d-4bb9-9e34-f35a537ac522?source=cvehttps://plugins.trac.wordpress.org/browser/tourfic/tags/2.23.5/inc/Traits/Action_Helper.php#L778https://plugins.trac.wordpress.org/browser/tourfic/tags/2.23.5/inc/Classes/Helper.php#L38https://plugins.trac.wordpress.org/browser/tourfic/tags/2.23.5/inc/App/TF_Review.php#L154#wordpress #themefic #Tourfic\u2013AIPoweredTravelBooking,HotelBooking&CarRental#CVE_2026_97470#bot", "creation_timestamp": "2026-10-16T13:37:55.824383Z"}]}