Plugin icon

WP Travel – Ultimate Travel Booking System, Tour Management Engine

wp-travel

Vulnerabilities:

13

Last Updated:

July 10, 2026

Active Installs:

4000

Published
Title
Fixed in
CVSS
Published
2026-07-13
Title
WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
Fixed in
Fixed in 11.8.1
CVSS
4.3 (medium)
Published
2026-07-13
Title
WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
Fixed in
Fixed in 11.8.1
CVSS
5.3 (medium)
Published
2026-06-29
Title
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
Fixed in
Fixed in 11.7.1
CVSS
5.3 (medium)
Published
2026-05-09
Title
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.5.0 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 11.5.0
CVSS
4.9 (medium)
Published
2026-01-21
Title
Travel < 11.1.1 - Missing Authorization
Fixed in
Fixed in 11.1.1
CVSS
5.3 (medium)
Published
2025-01-31
Title
WP Travel < 10.1.4 - Author+ SQL Injection
Fixed in
Fixed in 10.1.4
CVSS
4.9 (medium)
Published
2025-01-08
Title
WP Travel < 10.0.1 - Subscriber+ SQL Injection
Fixed in
Fixed in 10.0.1
CVSS
7.7 (high)
Published
2024-12-02
Title
WP Travel < 9.7.0 - Missing Authorization
Fixed in
Fixed in 9.7.0
CVSS
6.5 (medium)
Published
2024-09-23
Title
WP Travel < 9.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 9.4.0
CVSS
4.4 (medium)
Published
2023-11-03
Title
WP Travel < 7.8.1 - Unauthenticated AJAX Calls
Fixed in
Fixed in 7.8.1
CVSS
5.3 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.2.0
CVSS
6.1 (medium)
Published
2021-03-01
Title
WP Travel < 4.4.7 - Cross-Site Request Forgery
Fixed in
Fixed in 4.4.7
CVSS
4.3 (medium)
Published
2021-03-01
Title
Multiple Plugins - CSRF Nonce Bypasses
Fixed in
Fixed in 4.4.7
CVSS
5.4 (medium)