CVE-2026-109590
6.4
/ 中危
2026-10-28
07h16 +00:00
07h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an