Advisories · Technology

WP Travel Engine.

Every CVE that names WP Travel Engine among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-16737 CVE record

CVSS 5.3 Medium

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart
- WP Travel Engine
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-12501 CVE record

CVSS 5.3 Medium

WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification
- WP Travel Engine
- CWE-345
Not analysed yet 6 Aug 2026
CVE-2026-12500 CVE record

CVSS 7.5 High

WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
- WP Travel Engine
- Broken access control
Not analysed yet 30 Jul 2026
CVE-2026-10834 CVE record

CVSS 4.6 Medium

WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image
- WP Travel Engine
Not analysed yet 7 Jul 2026
CVE-2026-49770 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability
- WP Travel Engine
- Insecure deserialization
Not analysed yet 15 Jun 2026
CVE-2026-49078 CVE record

CVSS 7.5 High

WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability
- WP Travel Engine
- CWE-1284
Not analysed yet 15 Jun 2026
CVE-2025-59574 CVE record

CVSS 6.5 Medium

WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability
- WP Travel Engine
- Cross-site scripting (XSS)
Not analysed yet 22 Sept 2025
CVE-2025-49308 CVE record

CVSS 7.5 High

WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability
- WP Travel Engine
- File inclusion
Not analysed yet 6 Jun 2025
CVE-2025-30870 CVE record

CVSS 8.1 High

WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability
- WP Travel Engine
- File inclusion
Not analysed yet 1 Apr 2025
CVE-2025-30871 CVE record

CVSS 7.5 High

WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability
- WP Travel Engine
- File inclusion
Not analysed yet 27 Mar 2025
CVE-2024-37944 CVE record

CVSS 6.5 Medium

WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability
- WP Travel Engine
- Cross-site scripting (XSS)
Not analysed yet 20 Jul 2024
CVE-2024-32798 CVE record

CVSS 7.5 High

WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability
- WP Travel Engine
- Broken access control
Not analysed yet 9 Jun 2024
CVE-2024-30504 CVE record

CVSS 7.6 High

WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability
- WP Travel Engine
- SQL injection
Not analysed yet 29 Mar 2024
CVE-2024-30502 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability
- WP Travel Engine
- SQL injection
Not analysed yet 29 Mar 2024