Tour Master - Tour Booking, Travel, Hotel

Tour Master - Tour Booking, Travel, Hotel has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 7 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (50%). Other recurring categories include PHP Remote File Inclusion, Exposure Of Sensitive Information To An Unauthorized Actor.

7 of the records (88%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

6 independent researchers contributed these findings, most of them (2) reported by Bonds.

Strategic Overview

Avg CVSSMedium

7.0/ 10

Patch Coverage88%

Open

Fixed

Get automatic notifications for all Tour Master - Tour Booking, Travel, Hotel vulnerabilities before they are exploited.

Most severe open issueCVSS 7.5CVE-2025-69133

Tour Master - Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion

Read the full analysis

Vulnerability Records

8 records


2026-08-13 00:00	Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting Tour Master - Tour Booking < 5.4.8	`CVE-2026-14239`	7.2 High	N/A	Yes
2026-07-30 00:00	Tourmaster <= 5.4.8 - Unauthenticated Information Exposure Tour Master - Tour Booking <= 5.4.8	`CVE-2026-14240`	5.3 Medium	Anonymous	Yes
2026-06-29 00:00	Tour Master - Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion Tour Master - Tour Booking <= 5.4.5	`CVE-2025-69133`	7.5 High	João Pedro S Alcântara (Kinorth)	No
2025-05-21 00:00	Tourmaster <= 5.3.8 - Unauthenticated Local File Inclusion Tour Master - Tour Booking <= 5.3.8	`CVE-2025-48292`	9.8 Critical	Bonds	Yes
2025-04-15 00:00	Tourmaster < 5.4.1 - Reflected Cross-Site Scripting Tour Master - Tour Booking < 5.4.1	`CVE-2025-32923`	6.1 Medium	Bonds	Yes
2025-02-17 21:19	Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter Tour Master - Tour Booking <= 5.3.7	`CVE-2024-13369`	6.5 Medium	Thái An	Yes
2025-01-09 00:00	Tour Master - Tour Booking, Travel, Hotel <= 5.3.4 - Reflected Cross-Site Scripting Tour Master - Tour Booking <= 5.3.4	`CVE-2024-12400`	6.1 Medium	Erwan LR	Yes
2024-12-16 00:00	Tour Master - Tour Booking, Travel, Hotel < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking Tour Master - Tour Booking < 5.3.4	`CVE-2024-11356`	7.2 High	Bob Matyas	Yes

Showing 1–8 of 8 reports