Goodlayers Tour Master — known CVE vulnerabilities

Every CVE whose affected-product data names Goodlayers Tour Master, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2024-12400 — CVSS 7.1 (high): The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected…
• CVE-2024-13369 — CVSS 6.5 (medium): The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’…
• CVE-2024-11356 — CVSS 6.1 (medium): The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could…