What is GHSA-3hhc-3pgw-rhv3?

GHSA-3hhc-3pgw-rhv3 is a security advisory published by GitHub Security Advisories with High severity. The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF...

Which CVE IDs does GHSA-3hhc-3pgw-rhv3 cover?

GHSA-3hhc-3pgw-rhv3 covers the following CVE IDs: CVE-2026-103303. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3hhc-3pgw-rhv3?

GHSA-3hhc-3pgw-rhv3 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-3hhc-3pgw-rhv3HighCVSS 8.8

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-103303 →

📋 Description

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-103303
https://wpscan.com/vulnerability/10693b34-ab03-4c24-bd9d-5a2efbfdbeb2
https://github.com/advisories/GHSA-3hhc-3pgw-rhv3