Log in Start free

GoodLayers

Products

ProductCVEsExploitedLatest
Tourmaster4–Aug 24, 2026
Goodlayers Hostel3–May 23, 2025
Goodlayers Hotel3–May 23, 2025
Modernize2–Aug 14, 2025
Goodlayers Core2–Oct 22, 2025
Goodlayers Blocks1–Mar 3, 2025
Tour Master - Tour Booking, Travel, Hotel1–Feb 18, 2025

Exploited and recent CVEs

  • CVE-2026-28166 High 7.1 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2025-69133 High 7.5 WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability 0.4%
  • CVE-2025-59580 High 8.8 WordPress Goodlayers Core plugin < 2.1.7 - Privilege Escalation vulnerability 0.4%
  • CVE-2025-53342 Medium 6.5 WordPress Modernize Theme <= 3.4.0 - Cross Site Scripting (XSS) Vulnerability 0.2%
  • CVE-2025-53343 Medium 4.3 WordPress Modernize Theme <= 3.4.0 - Broken Access Control Vulnerability 0.3%
  • CVE-2025-39500 Critical 9.8 WordPress Goodlayers Hostel Plugin <= 3.1.2 - PHP Object Injection vulnerability 0.6%
  • CVE-2025-39501 Critical 9.3 WordPress Goodlayers Hostel plugin <= 3.1.4 - SQL Injection vulnerability 0.5%
  • CVE-2025-39502 High 7.1 WordPress Goodlayers Hostel Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2025-39503 Critical 9.8 WordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerability 0.6%
  • CVE-2025-39504 Critical 9.3 WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerability 0.5%
  • CVE-2025-39505 High 7.1 WordPress Goodlayers Hotel plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2025-48292 High 8.1 WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability 0.7%
  • CVE-2025-32923 High 7.1 WordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-23521 High 7.1 WordPress Goodlayers Blocks plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-13369 Medium 6.5 Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter 0.5%
  • CVE-2024-11200 Medium 6.1 Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family' 0.3%