GoodLayers Tourmaster plugins older than version 5.4.1 contain an improper neutralization of user supplied data when generating web pages, resulting in a reflected cross‑site scripting vulnerability. An attacker that can provoke the plugin to return a page containing crafted input can inject arbitrary JavaScript that is executed in the browser of visitors who view the affected page. This can lead to session hijacking, credential theft, defacement, or further propagation of malware on victim sites.

WordPress installations that have the GoodLayers Tourmaster plugin at a version earlier than 5.4.1 are affected. The vulnerability applies to all releases of Tourmaster from its initial release up to the pre‑5.4.1 series.

The CVSS score of 7.1 classifies this as a medium‑to‑high severity issue. The EPSS score of less than 1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a link or form that causes a vulnerable Tourmaster page to reflect the payload, implying a web‑based, remote exploitation path that requires user interaction.