The Turisbook Booking System WordPress plugin through version 1.3.8 contains a flaw that allows an unauthenticated user to save a background setting without authorization or CSRF enforcement. The value of that setting is later rendered in an administrative page without sanitization or escaping, enabling a stored cross‑site scripting attack. An attacker can inject arbitrary JavaScript that runs in the browser context of any site administrator visiting the affected page, potentially leading to session hijacking, credential theft, defacement, or delivery of more complex malware.

Any WordPress website that has the Turisbook Booking System plugin installed with a version equal to or older than 1.3.8 is affected. No other vendors or products are listed in the CNA data. Site administrators and editors who have access to the admin interface of the vulnerable plugin are the primary users at risk.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. However, due to the lack of authorization checks and the absence of both CSRF protection and output sanitization, the flaw is trivially exploitable from any external IP. Once the malicious background value is stored, every subsequent visit to the admin page by an authenticated administrator will execute the script, placing the attack in the high‑risk tier. The likely attack vector is an unauthenticated HTTP request to the plugin’s settings endpoint that accepts and persists the untrusted background value.