WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-tournament-registration
Published
2025-08-05
Title
WP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter
Slug
wp-tradingview
Published
2024-04-15
Title
WP TradingView <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-transactions
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-translate
Published
2024-06-03
Title
WP Translate <= 5.3.0 - Missing Authorization
Slug
wp-translitera
Published
2023-03-03
Title
WP Translitera <= p1.2.5 - Settings Update via CSRF
Slug
wp-travel
Published
2021-03-01
Title
Multiple Plugins - CSRF Nonce Bypasses
Slug
wp-travel
Published
2021-03-01
Title
WP Travel < 4.4.7 - Cross-Site Request Forgery
Slug
wp-travel
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-travel
Published
2023-11-03
Title
WP Travel < 7.8.1 - Unauthenticated AJAX Calls
Slug
wp-travel
Published
2024-09-23
Title
WP Travel < 9.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-travel
Published
2024-12-02
Title
WP Travel < 9.7.0 - Missing Authorization
Slug
wp-travel
Published
2025-01-08
Title
WP Travel < 10.0.1 - Subscriber+ SQL Injection
Slug
wp-travel
Published
2025-01-31
Title
WP Travel < 10.1.4 - Author+ SQL Injection
Slug
wp-travel
Published
2026-01-21
Title
Travel < 11.1.1 - Missing Authorization
Slug
wp-travel
Published
2026-05-09
Title
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.5.0 - Authenticated (Contributor+) SQL Injection
Slug
wp-travel
Published
2026-06-29
Title
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
Slug
wp-travel
Published
2026-07-13
Title
WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
Slug
wp-travel
Published
2026-07-13
Title
WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
Slug
wp-travel
Published
2026-09-07
Title
WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
Slug
wp-travel
Published
2026-09-07
Title
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
Slug
wp-travel
Published
2026-09-07
Title
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
Slug
wp-travel-blocks
Published
2024-08-16
Title
WP Travel Gutenberg Blocks < 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-travel-blocks
Published
2024-09-30
Title
WP Travel Gutenberg Blocks < 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-travel-blocks
Published
2025-07-01
Title
WP Travel Gutenberg Blocks < 3.9.1 - Unauthenticated Local File Inclusion
Slug
wp-travel-blocks
Published
2025-10-16
Title
WP Travel Gutenberg Blocks < 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting