The vulnerability allows an authenticated user with subscriber‑level access to place arbitrary JavaScript into comment content because the plugin does not sanitize input and fails to escape output. When the comment is later retrieved via the REST endpoint or RSS feeds, the malicious script runs in the browsers of any user who views the affected page or feed, enabling session hijacking, defacement, or delivery of further malware. The weakness is a classic input validation flaw (CWE‑79).

All installations of the Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin up to and including version 3.0.1 are vulnerable. The plugin must be used in a WordPress site with WooCommerce active, as the customer role is self‑registerable without administrative approval, so any visitor can acquire the required subscriber privilege and post a malicious comment.

The CVSS score of 6.4 places the vulnerability in the medium severity range, and the EPSS score is not available. It is not currently listed in CISA’s KEV catalog, indicating no confirmed, large‑scale exploitation in the wild. Exploitation requires legitimate authentication to a customer role and the ability to post a comment; it is then stored and exposed to any visitor from the /wp-json/wp/v2/comments endpoint or RSS feeds, making it fairly easy to reach unsuspecting users who load comment content, even via headless clients or third‑party widgets.