Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Tourfictourfic-pro
Plugin · tourfic
Tourfic
16 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 16, 2026Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental: Stored Cross-Site ScriptingCVE-2026-97470 · affects up to 3.0.1 · reported by WordfenceMedium 6.4
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. While the plugin's own listing-page templates sanitize output with wp_kses_post(), the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds, exposing any headless client, feed reader, or third-party widget that renders comment content.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental: Stored Cross-Site ScriptingCVE-2026-103480 · affects up to 3.0.1 · reported by WordfenceMedium 6.4
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on save does not strip the payload because angle-bracket characters are not required, allowing the unescaped attribute value to survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.
Aug 13, 2026Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.CVE-2026-27999 · affects up to 2.23.1 · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
Jul 13, 2026Tourfic: Missing AuthorizationCVE-2026-57395 · affects up to 2.22.5 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.
Jul 13, 2026Tourfic: Missing AuthorizationCVE-2026-57392 · affects up to 2.22.5 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.
Jun 26, 2026Subscriber SQL Injection in Tourfic <= 2.22.5 versions.CVE-2026-56064 · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Tourfic <= 2.22.5 versions.
Jun 25, 2026Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental: Generic SQL InjectionCVE-2026-12937 · affects up to 2.22.7 · reported by WordfenceHigh 7.5
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler is registered for unauthenticated users via wp_ajax_nopriv_tf_room_availability, and the required nonce is emitted on the public single-hotel page template, allowing unauthenticated attackers to freely obtain a valid nonce and reach the vulnerable code path.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Tourfic: Missing AuthorizationCVE-2026-39543 · affects up to 2.21.4 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.
Aug 26, 2025Tourfic: Unauthorized modification of dataCVE-2024-8860 · affects up to 2.14.5 · reported by WordfenceMedium 4.3
The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions in all versions up to, and including, 2.14.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively.
Jan 24, 2025Tourfic: Unrestricted Upload of File with Dangerous TypeCVE-2025-24650 · affects up to 2.15.3 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.
Dec 24, 2024Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking: SQL InjectionCVE-2024-12032 · affects up to 2.15.3 · reported by WordfenceMedium 6.5
The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiry_id' parameter of the 'tf_enquiry_reply_email_callback' function in all versions up to, and including, 2.15.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2024Tourfic: Cross-Site Request ForgeryCVE-2024-8319 · affects up to 2.11.20 · reported by WordfenceMedium 4.3
The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions. This makes it possible for unauthenticated attackers to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 19, 2024Tourfic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29137 · affects up to 2.11.7 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.
Mar 19, 2024Tourfic: Deserialization of Untrusted DataCVE-2024-29136 · affects up to 2.11.17 · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.
Mar 19, 2024Tourfic: Unrestricted Upload of File with Dangerous TypeCVE-2024-29135 · affects up to 2.11.15 · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.
Mar 19, 2024Tourfic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29134 · affects up to 2.11.8 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.