Advisories · Technology
magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce.
Every CVE that names magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen
- magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce
- Broken access control
- CVSS 4.3 Medium
Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
- magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce
- Broken access control
- CVSS 6.4 Medium
Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
- magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce
- Cross-site scripting (XSS)