---
id: CVE-2026-109590
title: >-
  Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
  via 'width', 'height', and 'zoom' Shortcode Attributes
summary: >-
  The Tour Booking Manager plugin for WordPress is vulnerable to Stored
  Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes
  of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This
  is due to…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: magepeopleteam
product: Travelly – Tour & Travel Booking Manager for WooCommerce
affected:
  - travelly_tour_travel_booking_manager_for_woocommerce <= 2.3.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T01:35:12.190161Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T01:41:54.301Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109590'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/2100f72a-ff75-4429-8dc6-be5b6e3c84cb?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/tour-booking-manager/tags/2.3.6/inc/TTBM_Shortcodes.php#L91
  - url: >-
      https://plugins.trac.wordpress.org/browser/tour-booking-manager/tags/2.3.6/inc/TTBM_Shortcodes.php#L76
  - url: 'https://github.com/magepeopleteam/tour-booking-manager'
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3757674/tour-booking-manager/trunk/inc/TTBM_Shortcodes.php
tags:
  - cve.org
epss: 0.00243
epssPercentile: 0.1561
ingestedAt: '2026-10-28T07:06:27.128Z'
---

## Overview

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## Affected

- `travelly_tour_travel_booking_manager_for_woocommerce <= 2.3.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.