magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce

• CVE-2026-111213 Medium 4.3 Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter 0.2%
• CVE-2026-109590 Medium 6.4 Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes 0.2%