WP
Vendor
wptravelengine
20
CVEs
0
On KEV
0
New 30D
Products
WT9.8
WP Travel Engine
Wptravelengine
9 CVEs0 on KEV0 new
WT9.8
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
wptravelengine
7 CVEs0 on KEV0 new
TM5.3
Travel Monster
wptravelengine
2 CVEs0 on KEV0 new
TB5.3
Travel Booking
wptravelengine
1 CVEs0 on KEV0 new
WT8.8
WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor
wptravelengine
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-9231 | WT WP Travel Engine – Tour Booking Plugin – Tour Operator Software wptravelengine | 7.5 | Sep 22 | WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute |
| CVE-2026-17087 | WT WP Travel Engine – Tour Booking Plugin – Tour Operator Software wptravelengine | 7.5 | Aug 16 | WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter |
| CVE-2026-2437 | WT WP Travel Engine – Tour Booking Plugin – Tour Operator Software wptravelengine | 6.4 | Apr 4 | WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode |
| CVE-2026-32486 | TB Travel Booking wptravelengine | 5.3 | Mar 13 | WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability |
| CVE-2026-24607 | TM Travel Monster wptravelengine | 5.3 | Jan 23 | WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability |
| CVE-2025-7634 | WT WP Travel Engine – Tour Booking Plugin – Tour Operator Software wptravelengine | 9.8 | Oct 9 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion |
| CVE-2025-7526 | WT WP Travel Engine – Tour Booking Plugin – Tour Operator Software wptravelengine | 9.8 | Oct 9 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming |
| CVE-2025-5282 | WT WP Travel Engine – Tour Booking Plugin – Tour Operator Software wptravelengine | 7.5 | Jun 13 | WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion |
| CVE-2025-30870 | WT WP Travel Engine Wptravelengine | 9.8 | Apr 1 | WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability |
| CVE-2025-30871 | WT WP Travel Engine Wptravelengine | 7.5 | Mar 27 | WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability |
| CVE-2024-37272 | TM Travel Monster wptravelengine | 4.3 | Jan 2 | WordPress Travel Monster theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-12272 | WT WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor wptravelengine | 8.8 | Dec 25 | WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion |
| CVE-2024-10606 | WT WP Travel Engine – Tour Booking Plugin – Tour Operator Software wptravelengine | 4.3 | Nov 23 | WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update |
| CVE-2024-37944 | WT WP Travel Engine Wptravelengine | 5.4 | Jul 20 | WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-32798 | WT WP Travel Engine Wptravelengine | 5.3 | Jun 9 | Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0 |
| CVE-2024-30504 | WT WP Travel Engine Wptravelengine | 7.2 | Mar 29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9 |
| CVE-2024-30502 | WT WP Travel Engine Wptravelengine | 9.8 | Mar 29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9 |
| CVE-2021-24680 | WT WP Travel Engine Wptravelengine | 5.4 | Jan 3 | The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users… |