WP Travel Engine – Tour Booking Plugin – Tour Operator Software vulnerabilities

Product

WP Travel Engine – Tour Booking Plugin – Tour Operator Software

by wptravelengine · last CVE Sep 22, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 2High 3Medium 2Low 0

Severity

Exploitation

Watch

Add WP Travel Engine – Tour Booking Plugin – Tour Operator Software to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-7634	9.8	1%	Oct 9	WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion Affected: through 6.6.7
CVE-2025-7526	9.8	1%	Oct 9	WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming Affected: through 6.6.7
CVE-2026-9231	7.5	1%	Sep 22	WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute Affected: through 6.8.0
CVE-2026-17087	7.5	1%	Aug 16	WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter Affected: through 6.8.4
CVE-2025-5282	7.5	0%	Jun 13	WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion Affected: through 6.5.1
CVE-2026-2437	6.4	0%	Apr 4	WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode Affected: through 6.7.5
CVE-2024-10606	4.3	0%	Nov 23	WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update Affected: through 6.2.1