CVE-2024-12400: 
WordPress vulnerability analysis and mitigation

The tourmaster WordPress plugin before version 5.3.5 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by Erwan LR from WPScan and was publicly disclosed on January 9, 2025. The issue affects the plugin's URL handling functionality where generated URLs are not properly escaped before being output in attributes (WPScan Vuln).

The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue with a CVSS score of 7.1 (High). The vulnerability exists because the plugin fails to properly escape generated URLs before outputting them in attributes. This security issue particularly affects the admin interface when handling room orders (WPScan Vuln).

When exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to unauthorized access to sensitive information or manipulation of the admin interface (WPScan Vuln).

The vulnerability has been fixed in version 5.3.5 of the tourmaster plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan Vuln).