CVE-2026-97470

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through an unfiltered_html grant to the Customer role in all versions up to and including 3.0.1 due to insufficient input sanitization and output escaping. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. The stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint and post/comment RSS feeds, exposing headless clients, feed readers, and third-party widgets.

An attacker can inject arbitrary scripts into pages and RSS feeds that execute when users view the injected content, potentially leading to session theft, account takeover, or further attacks in the victim's browser context. The risk is high because exploitation requires no admin approval and is available to anyone who registers a WooCommerce account.

Update the Tourfic plugin to a version later than 3.0.1 as soon as it becomes available, and until then consider restricting self-registration of WooCommerce accounts and filtering comment content returned by the REST endpoint and RSS feeds. Additionally, enforce server-side input validation and sanitization and monitor for unusual comment content.