WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
totalprocessing-card-payments
Published
2025-05-02
Title
Nomupay Payment Processing Gateway < 7.1.8 - Shop Manager+ Arbitrary File Download
Slug
totop-link
Published
2021-11-15
Title
ToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection
Slug
tour-booking-manager
Published
2024-04-12
Title
WpTravelly < 1.6.1 - Cross-Site Request Forgery
Slug
tour-booking-manager
Published
2024-05-28
Title
WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly < 1.7.2 - Missing Authorization via ttbm_new_place_save
Slug
tour-booking-manager
Published
2024-08-09
Title
WpTravelly < 1.7.8 - Missing Authorization
Slug
tour-booking-manager
Published
2025-01-14
Title
WpTravelly < 1.8.6 - Missing Authorization
Slug
tour-booking-manager
Published
2025-03-27
Title
WpTravelly < 1.8.8 - Authenticated (Contributor+) Local File Inclusion
Slug
tour-booking-manager
Published
2025-04-01
Title
WpTravelly < 1.8.8 - Authenticated (Contributor+) PHP Object Injection
Slug
tour-operator
Published
2024-11-20
Title
LSX Tour Operator < 2.0.0 - Author+ Stored XSS via SVG File Upload
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.8 - Reflected Cross-Site Scripting
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.19 - Authenticated (Subscriber+) PHP Object Injection
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.16 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
tourfic
Published
2024-08-29
Title
Tourfic < 2.11.21 - Cross-Site Request Forgery in Multiple Functions
Slug
tourfic
Published
2024-12-24
Title
Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking < 2.15.4 - Authenticated (Subscriber+) SQL Injection
Slug
tourfic
Published
2025-01-24
Title
Tourfic < 2.15.4 - Authenticated (Admin+) Arbitrary File Upload
Slug
tourmaster
Published
2024-12-16
Title
Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
Slug
tourmaster
Published
2025-01-09
Title
Tourmaster < 5.3.5 - Reflected XSS
Slug
tourmaster
Published
2025-02-17
Title
Tour Master - Tour Booking, Travel, Hotel < 5.3.8 - Authenticated (Subscriber+) SQL Injection via review_id Parameter
Slug
tourmaster
Published
2025-04-15
Title
Tourmaster < 5.4.1 - Reflected Cross-Site Scripting
Slug
tourmaster
Published
2025-05-21
Title
Tourmaster < 5.3.9 - Unauthenticated Local File Inclusion
Slug
tournamatch
Published
2024-06-22
Title
WordPress Plugin Tournamatch < 4.6.1 - Subscriber+ Stored XSS
Slug
tournamatch
Published
2024-06-22
Title
WordPress Plugin Tournamatch < 4.6.1 - Admin+ Stored XSS via Ladders
Slug
tournamatch
Published
2025-04-09
Title
Tournamatch <= 4.7.0 - Reflected Cross-Site Scripting
Slug
tournamatch
Published
2025-05-22
Title
Tournamatch < 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting