CVE-2026-1806: 
WordPress vulnerability analysis and mitigation

CVE-2026-1806 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tour & Activity Operator Plugin for TourCMS plugin for WordPress. It affects all versions up to and including 1.7.0, where insufficient input sanitization and output escaping of the target parameter in the tourcms_doc_link shortcode allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. The vulnerability was published on March 21, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a stored XSS variant. The vulnerable code resides in tourcms-plugin.php at line 1530, where the target parameter passed to the tourcms_doc_link shortcode is neither sanitized on input nor escaped on output before being rendered in the page HTML. An authenticated attacker with at least Contributor-level WordPress access can craft a post or page containing a malicious shortcode payload; the injected script then executes in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows injected JavaScript to execute in the context of any visitor's browser on pages containing the malicious shortcode, impacting confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page content manipulation, phishing redirects). Because the payload is stored server-side, all users accessing the compromised page are affected without any additional attacker interaction. Availability is not directly impacted, but the attack can be used to facilitate account takeover or further compromise of the WordPress site (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1806 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Tour & Activity Operator Plugin for TourCMS at version 1.7.0 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a tourcms_doc_link shortcode with a malicious target parameter, e.g., [tourcms_doc_link target="javascript:alert(document.cookie)"] or an equivalent XSS payload.
4. Publish the Page: Submit or publish the post/page containing the injected shortcode. The payload is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to post/page creation or editing endpoints (/wp-admin/post.php) containing tourcms_doc_link shortcode with unusual target parameter values (e.g., JavaScript URIs or encoded script tags).
• Database: WordPress wp_posts table entries containing tourcms_doc_link shortcodes with suspicious target values such as javascript:, <script>, or base64-encoded payloads.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages hosting the plugin's shortcode.
• File System: Unexpected modifications to tourcms-plugin.php or related plugin files that may indicate further tampering post-exploitation.

Site administrators should update the Tour & Activity Operator Plugin for TourCMS to version 1.7.1 or later, which addresses the insufficient sanitization and escaping of the target parameter. If an immediate update is not possible, restrict Contributor-level user registrations or disable the tourcms_doc_link shortcode functionality until the patch is applied. Reviewing existing posts and pages for suspicious shortcode usage is also recommended as a post-incident measure (Wordfence).