The Tour Booking Manager plugin for WordPress suffers from a Stored Cross‑Site Scripting vulnerability in the [ttbm‑hotel‑map] shortcode; the width, height, and zoom attributes are concatenated into an iframe tag without proper sanitization or escaping, allowing an attacker to inject arbitrary JavaScript into pages that any site visitor will load. This flaw can be exploited by any authenticated user with contributor-level access or higher, giving the attacker the ability to run scripts in the context of site visitors and potentially steal credentials, deface content, or redirect users to malicious sites.

This issue affects the magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce plugin, versions up to and including 2.3.6. No other versions are listed as affected.

The CVSS score of 6.4 classifies the payload as Medium severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires authenticated access, and an intruder can embed malicious scripts that will execute for every visitor to the affected pages, enabling user‑impersonation or session hijacking scenarios. While the flaw does not allow direct remote code execution on the server, it can compromise user accounts and the integrity of the site’s front‑end.