Tours

Tours has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Tours has a vendor fix available, so running the current release closes it.

All of these findings were reported by Rafie Muhammad. Tours is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.

Strategic Overview

Avg CVSSMedium

4.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Tours vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2024-51666

Tours <= 1.0.0 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records


2025-05-15 00:00	Tours <= 1.0.0 - Missing Authorization Tours <= 1.0.0	`CVE-2024-51666`	4.3 Medium	Rafie Muhammad	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv1.0.1

Tours

Author

Tosin Oguntuyi

0.0(0)

0/100

Last Updated

2026-08-22 (22d ago)

Active Installs

10+

Downloads

1,150

Requires WP

5.0+

Requires PHP

5.6+

Tested up to

WP 6.5.10

Created

2024-05-23 (2y ago)

Tours is a plugin that allows you to create tours for your site. They can be activated by the user by clicking colored glowing buttons. Creating the tour is done by entering a creation mode where the HTML tag to be used is highlighted. You can then enter the text for the step, and create a new step by clicking on the next tag to be highlighted. Credits driver.js by Kamran Ahmed. Build version – https://github.com/trymebytes/driver.js/tree/fix-accessibility

View on WordPress.org