Read the docs

Travelpayouts

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Travelpayouts records in CISA KEV

No Travelpayouts vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Travelpayouts 3 records HIGH

Records

4 records

TI-2023-05466 CVE-2023-5934 · GHSA-vcpp-7qvc-rxv7

Travelpayouts < 1.1.13 - Settings Update via CSRF

Priority HIGH 65

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some se…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00251 Published 2025-05-15 Fixed in 1.1.13 CWE-352
TI-2024-00305 CVE-2024-0337 · GHSA-7ph5-37r4-fwh8

Travelpayouts <= 1.1.15 - Open Redirect

Priority MEDIUM 60

The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00891 Published 2024-03-20 No fix listed CWE-601
TI-2023-05464 CVE-2023-5932 · GHSA-c9v2-rqm3-3g5r

Travelpayouts < 1.1.14 - Reflected XSS

Priority MEDIUM 55

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00389 Published 2025-05-15 Fixed in 1.1.14 CWE-79
TI-2025-41651 CVE-2025-68042 · GHSA-g5wr-mqvx-5c3v

WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability

Priority LOW 28

Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00243 Published 2026-02-20 No fix listed CWE-862
Open these records in search →