Advisories · Technology
WP Travel.
Every CVE that names WP Travel among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
- WP Travel
- Broken access control
- CVSS 3.7 Low
WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
- WP Travel
- Broken access control
- CVSS 3.7 Low
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
- WP Travel
- Broken access control
- CVSS 4.3 Medium
WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
- WP Travel
- Broken access control
- CVSS 5.3 Medium
WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
- WP Travel
- Authentication bypass
- CVSS 5.3 Medium
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
- WP Travel
- Broken access control
- CVSS 7.7 High
WordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerability
- WP Travel
- SQL injection
- CVSS 5.3 Medium
WordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerability
- WP Travel
- Broken access control
- CVSS 7.6 High
WordPress WP Travel plugin <= 10.1.3 - SQL Injection vulnerability
- WP Travel
- SQL injection
- CVSS 7.5 High
WordPress WP Travel plugin <= 7.8.0 - Broken Access Control vulnerability
- WP Travel
- Broken access control
- CVSS 6.5 Medium
WordPress WP Travel plugin <= 9.6.0 - Broken Access Control vulnerability
- WP Travel
- Broken access control
- CVSS 5.9 Medium
WordPress WP Travel plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability
- WP Travel
- Cross-site scripting (XSS)