Plugin icon

WP Travel Engine – Tour Booking Plugin – Tour Operator Software

wp-travel-engine

Vulnerabilities:

15

Last Updated:

March 30, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2026-04-03
Title
WP Travel Engine - Travel and Tour Booking Plugin < 6.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode
Fixed in
Fixed in 6.7.6
CVSS
5.5 (medium)
Published
2025-10-08
Title
WP Travel Engine – Tour Booking Plugin – Tour Operator Software < 6.6.8 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 6.6.8
CVSS
9.8 (critical)
Published
2025-10-08
Title
WP Travel Engine – Tour Booking Plugin – Tour Operator Software < 6.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
Fixed in
Fixed in 6.6.8
CVSS
9.8 (critical)
Published
2025-06-12
Title
WP Travel Engine < 6.5.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Fixed in
Fixed in 6.5.2
CVSS
7.5 (high)
Published
2025-06-05
Title
WP Travel Engine < 6.5.2 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 6.5.2
CVSS
8.8 (high)
Published
2025-03-27
Title
WP Travel Engine < 6.3.6 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 6.3.6
CVSS
8.8 (high)
Published
2025-03-27
Title
WP Travel Engine < 6.3.6 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 6.3.6
CVSS
9.8 (critical)
Published
2024-11-22
Title
WP Travel Engine < 6.2.2 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
Fixed in
Fixed in 6.2.2
CVSS
4.3 (medium)
Published
2024-07-10
Title
WP Travel Engine < 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.9.2
CVSS
6.4 (medium)
Published
2024-04-22
Title
WP Travel Engine < 5.8.1 - Unauthenticated Price Manipulation
Fixed in
Fixed in 5.8.1
CVSS
5.3 (medium)
Published
2024-03-28
Title
WP Travel Engine < 5.8.0 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 5.8.0
CVSS
9.1 (critical)
Published
2024-03-28
Title
WP Travel Engine < 5.8.0 - Unauthenticated SQL Injection
Fixed in
Fixed in 5.8.0
CVSS
10 (critical)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.7.5
CVSS
6.1 (medium)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 5.3.8
CVSS
4.3 (medium)
Published
2021-12-01
Title
WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting
Fixed in
Fixed in 5.3.1
CVSS
3.5 (low)