Read the docs

wptravelengine

Records23All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

wptravelengine records in CISA KEV

No wptravelengine vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp Travel Engine 9 records MEDIUM

Records

9 records in Wp Travel Engine · all components

TI-2025-22140 CVE-2025-30870 · GHSA-p7rf-4rp4-q9q8

WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

Priority MEDIUM 43

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00797 Published 2025-04-01 No fix listed CWE-98
TI-2025-04745 CVE-2025-5282 · GHSA-jq5m-6mwv-f3j3

WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

Priority LOW 39

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00296 Published 2025-06-13 No fix listed CWE-862
TI-2025-22141 CVE-2025-30871 · GHSA-h5gw-682p-v2c8

WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

Priority LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affec…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01003 Published 2025-03-27 No fix listed CWE-98
TI-2024-20228 CVE-2024-30504 · GHSA-vrgq-j293-jcx7

WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00574 Published 2024-03-29 No fix listed CWE-89
TI-2024-25250 CVE-2024-37944 · GHSA-wf73-c9rj-g2f9

Cross-site scripting in wptravelengine WP Travel Engine

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00277 Published 2024-07-20 No fix listed CWE-79
TI-2021-06962 CVE-2021-24680 · GHSA-3v2q-4w56-hr98

WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting

Priority LOW 25

The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Sto…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2022-01-03 Fixed in 5.3.1 CWE-79
TI-2024-09828 CVE-2024-10606 · GHSA-x927-42v3-5v36

WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

Priority LOW 20

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback() f…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00305 Published 2024-11-23 No fix listed CWE-862
Open these records in search →