What’s Vulnerable › Products
WP Travel Engine vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.
Check whether your WP Travel Engine version is affected
Latest WP Travel Engine vulnerabilities
- CVE-2026-9231 — WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute (CVSS 7.5)
- CVE-2026-17087 — WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter (CVSS 7.5)
- CVE-2026-49770 — WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability (CVSS 9.8)
- CVE-2026-49078 — WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability (CVSS 7.5)
- CVE-2026-2437 — WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode (CVSS 6.4)
- CVE-2025-7634 — WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion (CVSS 9.8)
- CVE-2025-7526 — WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming (CVSS 9.8)
- CVE-2025-59574 — WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- CVE-2025-5282 — WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 7.5)
- CVE-2025-49308 — WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability (CVSS 7.5)
- CVE-2025-30870 — WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability (CVSS 9.8)
- CVE-2025-30871 — WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability (CVSS 7.5)
- CVE-2024-10606 — WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update (CVSS 4.3)
- CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- CVE-2024-37944 — WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-32798 — WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability (CVSS 5.3)
- CVE-2024-30504 — WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability (CVSS 7.2)
- CVE-2024-30502 — WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability (CVSS 9.8)
- CVE-2021-24680 — WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting (CVSS 5.4)