WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-travel
Published
2026-01-21
Title
Travel < 11.1.1 - Missing Authorization
Slug
wp-travel
Published
2026-05-09
Title
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.5.0 - Authenticated (Contributor+) SQL Injection
Slug
wp-travel
Published
2026-06-29
Title
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
Slug
wp-travel
Published
2026-07-13
Title
WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
Slug
wp-travel
Published
2026-07-13
Title
WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
Slug
wp-travel
Published
2026-09-08
Title
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 12.0.4 - Missing Authorization
Slug
wp-travel
Published
2026-09-07
Title
WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
Slug
wp-travel
Published
2026-09-07
Title
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
Slug
wp-travel
Published
2026-09-07
Title
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
Slug
wp-travel-blocks
Published
2024-08-16
Title
WP Travel Gutenberg Blocks < 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-travel-blocks
Published
2024-09-30
Title
WP Travel Gutenberg Blocks < 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-travel-blocks
Published
2025-07-01
Title
WP Travel Gutenberg Blocks < 3.9.1 - Unauthenticated Local File Inclusion
Slug
wp-travel-blocks
Published
2025-10-16
Title
WP Travel Gutenberg Blocks < 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-travel-blocks
Published
2026-06-17
Title
WP Travel Gutenberg Blocks < 3.9.5 - Unauthenticated SQL Injection
Slug
wp-travel-engine
Published
2021-12-01
Title
WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting
Slug
wp-travel-engine
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-travel-engine
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-travel-engine
Published
2024-03-28
Title
WP Travel Engine < 5.8.0 - Unauthenticated SQL Injection
Slug
wp-travel-engine
Published
2024-03-28
Title
WP Travel Engine < 5.8.0 - Authenticated (Administrator+) SQL Injection
Slug
wp-travel-engine
Published
2024-04-22
Title
WP Travel Engine < 5.8.1 - Unauthenticated Price Manipulation
Slug
wp-travel-engine
Published
2024-07-10
Title
WP Travel Engine < 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-travel-engine
Published
2024-11-22
Title
WP Travel Engine < 6.2.2 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
Slug
wp-travel-engine
Published
2025-03-27
Title
WP Travel Engine < 6.3.6 - Authenticated (Contributor+) Local File Inclusion
Slug
wp-travel-engine
Published
2025-03-27
Title
WP Travel Engine < 6.3.6 - Unauthenticated Local File Inclusion
Slug
wp-travel-engine
Published
2025-06-05
Title
WP Travel Engine < 6.5.2 - Authenticated (Contributor+) Local File Inclusion