WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
tour-booking-manager
Published
2025-04-01
Title
WpTravelly < 1.8.8 - Authenticated (Contributor+) PHP Object Injection
Slug
tour-booking-manager
Published
2026-03-21
Title
WpTravelly < 2.1.8 - Missing Authorization
Slug
tour-booking-manager
Published
2026-05-26
Title
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution < 2.1.6 - Missing Authorization
Slug
tour-booking-manager
Published
2026-06-01
Title
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution < 2.1.8 - Missing Authorization
Slug
tour-operator
Published
2024-11-20
Title
LSX Tour Operator < 2.0.0 - Author+ Stored XSS via SVG File Upload
Slug
tour-operator-plugin
Published
2026-03-20
Title
Tour & Activity Operator Plugin for TourCMS <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.8 - Reflected Cross-Site Scripting
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.19 - Authenticated (Subscriber+) PHP Object Injection
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.16 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
tourfic
Published
2024-03-18
Title
Tourfic < 2.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
tourfic
Published
2024-08-29
Title
Tourfic < 2.11.21 - Cross-Site Request Forgery in Multiple Functions
Slug
tourfic
Published
2024-12-24
Title
Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking < 2.15.4 - Authenticated (Subscriber+) SQL Injection
Slug
tourfic
Published
2025-01-24
Title
Tourfic < 2.15.4 - Authenticated (Admin+) Arbitrary File Upload
Slug
tourfic
Published
2026-03-28
Title
Tourfic < 2.21.5 - Missing Authorization
Slug
tourfic
Published
2026-06-24
Title
Tourfic < 2.22.8 - Unauthenticated SQL Injection via 'post_id' Parameter
Slug
tourfic
Published
2026-06-25
Title
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin < 2.22.6 - Authenticated (Subscriber+) SQL Injection
Slug
tourfic
Published
2026-07-08
Title
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin < 2.22.6 - Missing Authorization
Slug
tourfic
Published
2026-07-08
Title
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin < 2.22.6 - Missing Authorization
Slug
tourfic
Published
2026-08-11
Title
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin < 2.23.2 - Missing Authorization
Slug
tourmaster
Published
2024-12-16
Title
Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
Slug
tourmaster
Published
2025-01-09
Title
Tourmaster < 5.3.5 - Reflected XSS
Slug
tourmaster
Published
2025-02-17
Title
Tour Master - Tour Booking, Travel, Hotel < 5.3.8 - Authenticated (Subscriber+) SQL Injection via review_id Parameter
Slug
tourmaster
Published
2025-04-15
Title
Tourmaster < 5.4.1 - Reflected Cross-Site Scripting
Slug
tourmaster
Published
2025-05-21
Title
Tourmaster < 5.3.9 - Unauthenticated Local File Inclusion
Slug
tourmaster
Published
2026-06-29
Title
Tour Master - Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion