The conflict arises from insufficient input sanitization and output escaping on the Tourfic WordPress plugin, allowing an authenticated user with contributor privileges or higher to embed scripts within the 'type' attribute of shortcodes. When the plugin saves the attribute, the wp_kses_post filter fails to strip the payload because angle brackets are not required, preserving the malicious content until it is rendered. This leads to stored XSS that executes on all subsequent page views, compromising confidentiality and integrity for any user who visits the affected page.

The vulnerability has been confirmed in Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental up to and including version 3.0.1, produced by themefic. Any installation of these plugin versions on WordPress sites that grants contributor-level or higher access to users is potentially affected.

With a CVSS score of 6.4 the flaw is moderate but still exploitable; the EPSS score is unavailable, and it is not listed in the CISA KEV catalog. The attack vector, inferred from the description, relies on an authenticated attacker who can submit a malicious 'type' attribute via the administrative interface. Once injected, the script executes in the context of any unauthenticated user who views the affected page, enabling session theft or defacement. Given that the vulnerability persists within stored content, the scope covers all users who can view the impacted pages, with no additional network or system privileges required.