Security
فارسی
All products

wp-travel-engine

WordPress · Plugin
21 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode AttributeCVE-2026-9231 wp-travel-engine WordPress High Fix reported
Travel Engine <= 6.8.0 - Authenticated (Subscriber+) Arbitrary Media File MoveCVE-2026-10834 wp-travel-engine WordPress Medium Fix reported
Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and ModificationCVE-2026-16737 wp-travel-engine WordPress Medium Fix reported
Travel Engine <= 6.8.1 - Unauthenticated Payment BypassCVE-2026-12501 wp-travel-engine WordPress Medium Fix reported
WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' ParameterCVE-2026-17087 wp-travel-engine WordPress High Fix reported
WP Travel Engine – Tour Booking Plugin – Tour Operator Software < 6.8.2 - Missing Authorization to Unauthenticated Settings UpdateCVE-2026-12500 wp-travel-engine WordPress Medium Fix reported
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.10 - Missing AuthorizationCVE-2026-49078 wp-travel-engine WordPress Medium Fix reported
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.12 - Unauthenticated PHP Object InjectionCVE-2026-49770 wp-travel-engine WordPress High Fix reported
WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax ShortcodeCVE-2026-2437 wp-travel-engine WordPress Medium Fix reported
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File InclusionCVE-2025-7634 wp-travel-engine WordPress Critical Fix reported
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File RenamingCVE-2025-7526 wp-travel-engine WordPress Critical Fix reported
WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post DeletionCVE-2025-5282 wp-travel-engine WordPress High Fix reported
WP Travel Engine <= 6.5.1 - Authenticated (Contributor+) Local File InclusionCVE-2025-49308 wp-travel-engine WordPress High Fix reported
WP Travel Engine <= 6.3.5 - Authenticated (Contributor+) Local File InclusionCVE-2025-30871 wp-travel-engine WordPress High Fix reported
WP Travel Engine <= 6.3.5 - Unauthenticated Local File InclusionCVE-2025-30870 wp-travel-engine WordPress Critical Fix reported
WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings UpdateCVE-2024-10606 wp-travel-engine WordPress Medium Fix reported
WP Travel Engine <= 5.9.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-37944 wp-travel-engine WordPress Medium Fix reported
WP Travel Engine <= 5.8.0 - Unauthenticated Price ManipulationCVE-2024-32798 wp-travel-engine WordPress Medium Fix reported
WP Travel Engine <= 5.7.9 - Unauthenticated SQL InjectionCVE-2024-30502 wp-travel-engine WordPress Critical Fix reported
WP Travel Engine <= 5.7.9 - Authenticated (Administrator+) SQL InjectionCVE-2024-30504 wp-travel-engine WordPress Critical Fix reported