WPTravel
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| WP Travel – Ultimate Travel Booking System, Tour Management Engine | 2 | – | Jan 9, 2025 |
| WP Travel Pro | 1 | – | May 29, 2026 |
Exploited and recent CVEs
- CVE-2026-4290 WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators 0.3%
- CVE-2024-12067 WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection 0.5%
- CVE-2021-4389 WP Travel <= 4.4.6 - Cross-Site Request Forgery Bypass 0.5%