CVE-2026-97470 themefic CVE debrief

Who should care

Defenders responsible for WordPress installations with the Tourfic plugin should assess exposure and implement compensating controls. This includes verifying if the plugin is installed and if the version is 3.0.1 or lower. Defenders should prioritize verifying exposure and implementing compensating controls due to the relatively low CVSS score and limited details on exploitation.

Why it matters

The Tourfic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content. Defenders should prioritize verifying exposure and implementing compensating controls.

• Defenders must verify exposure by checking if the Tourfic plugin is installed and if the version is 3.0.1 or lower.
• Defenders must implement compensating controls, such as restricting access to the comment feature or using a Web Application Firewall (WAF) to detect and prevent XSS attacks.
• Defenders must remediate by updating the Tourfic plugin to a version that fixes the vulnerability, if available.

Technical summary

The Tourfic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access can inject arbitrary web scripts. The vulnerability requires WooCommerce to be active, and since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. The plugin's own listing-page templates sanitize output with wp_kses_post().

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls due to the relatively low CVSS score and limited details on exploitation.

Recommended defensive actions

• Verify exposure by checking if the Tourfic plugin is installed and if the version is 3.0.1 or lower.
• Implement compensating controls, such as restricting access to the comment feature or using a Web Application Firewall (WAF) to detect and prevent XSS attacks.
• Remediate by updating the Tourfic plugin to a version that fixes the vulnerability, if available.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence of exploitation is not provided. The vulnerability requires WooCommerce to be active, and since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. The source item and CVE Program record provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.