wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software

• CVE-2026-9231 High 7.5 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute 0.6%
• CVE-2026-17087 High 7.5 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter 0.7%
• CVE-2026-2437 Medium 6.4 WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode 0.2%
• CVE-2025-7634 Critical 9.8 WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion 0.8%
• CVE-2025-7526 Critical 9.8 WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming 0.9%
• CVE-2025-5282 High 7.5 WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion 0.3%
• CVE-2024-10606 Medium 4.3 WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update 0.3%