Plugin icon

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin

tourfic

Vulnerabilities:

8

Last Updated:

May 19, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-03-28
Title
Tourfic < 2.21.5 - Missing Authorization
Fixed in
Fixed in 2.21.5
CVSS
5.3 (medium)
Published
2025-01-24
Title
Tourfic < 2.15.4 - Authenticated (Admin+) Arbitrary File Upload
Fixed in
Fixed in 2.15.4
CVSS
7.2 (high)
Published
2024-12-24
Title
Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking < 2.15.4 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 2.15.4
CVSS
6.5 (medium)
Published
2024-08-29
Title
Tourfic < 2.11.21 - Cross-Site Request Forgery in Multiple Functions
Fixed in
Fixed in 2.11.21
CVSS
4.3 (medium)
Published
2024-03-18
Title
Tourfic < 2.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.11.9
CVSS
6.4 (medium)
Published
2024-03-18
Title
Tourfic < 2.11.8 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.11.8
CVSS
6.1 (medium)
Published
2024-03-18
Title
Tourfic < 2.11.16 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 2.11.16
CVSS
8.8 (high)
Published
2024-03-18
Title
Tourfic < 2.11.19 - Authenticated (Subscriber+) PHP Object Injection
Fixed in
Fixed in 2.11.19
CVSS
8.8 (high)