Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: wptravelengine Component: Wp Travel Engine Clear all filters
TI-2025-04745 CVE-2025-5282 · GHSA-jq5m-6mwv-f3j3

WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

Priority LOW 39

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00296 Published 2025-06-13 No fix listed CWE-862
TI-2025-22140 CVE-2025-30870 · GHSA-p7rf-4rp4-q9q8

WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

Priority MEDIUM 43

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00797 Published 2025-04-01 No fix listed CWE-98
TI-2025-22141 CVE-2025-30871 · GHSA-h5gw-682p-v2c8

WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

Priority LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affec…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01003 Published 2025-03-27 No fix listed CWE-98
TI-2024-09828 CVE-2024-10606 · GHSA-x927-42v3-5v36

WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

Priority LOW 20

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback() f…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00305 Published 2024-11-23 No fix listed CWE-862
TI-2024-25250 CVE-2024-37944 · GHSA-wf73-c9rj-g2f9

Cross-site scripting in wptravelengine WP Travel Engine

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00277 Published 2024-07-20 No fix listed CWE-79
TI-2024-20228 CVE-2024-30504 · GHSA-vrgq-j293-jcx7

WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00574 Published 2024-03-29 No fix listed CWE-89
TI-2021-06962 CVE-2021-24680 · GHSA-3v2q-4w56-hr98

WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting

Priority LOW 25

The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Sto…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2022-01-03 Fixed in 5.3.1 CWE-79