wptravelengine
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 7 | – | Sep 22, 2026 |
| Travel Monster | 2 | – | Jan 23, 2026 |
| Travel Booking | 1 | – | Mar 13, 2026 |
| WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor | 1 | – | Dec 25, 2024 |
Exploited and recent CVEs
- CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute 0.6%
- CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter 0.7%
- CVE-2026-2437 WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode 0.2%
- CVE-2026-32486 WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability 0.2%
- CVE-2026-24607 WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability 0.4%
- CVE-2025-7634 WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion 0.8%
- CVE-2025-7526 WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming 0.9%
- CVE-2025-5282 WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion 0.3%
- CVE-2024-37272 WordPress Travel Monster theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
- CVE-2024-12272 WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion 0.8%
- CVE-2024-10606 WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update 0.3%