The Tourmaster WordPress plugin before version 5.4.8 fails to perform a nonce check when a custom‑filter label is stored from a request parameter, and it does not escape that label when rendering it on the filter admin page. This combination allows an unauthenticated attacker to trick a logged‑in administrator into saving malicious JavaScript that will execute in the admin interface. The result is a stored Cross‑Site Scripting (XSS) vulnerability that can be abused through a Cross‑Site Request Forgery (CSRF) vector, compromising the confidentiality and integrity of the administrative session and potentially exposing or defacing the site content.

Any WordPress site that has the Tourmaster plugin installed and is running a version earlier than 5.4.8. The vulnerability exists in all affected installations regardless of additional security plugins or configurations, as the core issue lies in the plugin's lack of nonce validation and output escaping at the source.

The EPSS score is below 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack would require an unauthenticated attacker to host a malicious link or form that initiates a CSRF request to the site, and a target administrator would need to click that link or submit the form, after which the stored script runs with the admin's privileges. The severity is amplified only if the administrator interacts with the vulnerable page; otherwise, the risk remains theoretical. The CVSS base score is 7.1.