Skip to content
OpenAdvisories

Vendor

GoodLayers

16 known vulnerabilities.

Products

Tourmaster 4 Goodlayers Hotel 3 Goodlayers Hostel 3 Modernize 2 Goodlayers Core 2 Goodlayers Blocks 1 Tour Master - Tour Booking, Travel, Hotel 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-28166

    WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

    GoodLayers Tourmaster
  • High 7.5
    CVE-2025-69133

    WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability

    Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.

    GoodLayers Tourmaster
  • High 8.8
    CVE-2025-59580

    WordPress Goodlayers Core plugin < 2.1.7 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Escalation.This issue affects Goodlayers Core: from n/a through < 2.1.7.

    GoodLayers Goodlayers Core
  • High 7.1
    CVE-2025-39502

    WordPress Goodlayers Hostel Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Reflected XSS.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

    GoodLayers Goodlayers Hostel
  • High 7.1
    CVE-2025-39505

    WordPress Goodlayers Hotel plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Reflected XSS.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

    GoodLayers Goodlayers Hotel
  • High 8.1
    CVE-2025-48292

    WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through <= 5.3.8.

    GoodLayers Tourmaster
  • High 7.1
    CVE-2025-32923

    WordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Tourmaster tourmaster allows Reflected XSS.This issue affects Tourmaster: from n/a through < 5.4.1.

    GoodLayers Tourmaster
  • High 7.1
    CVE-2025-23521

    WordPress Goodlayers Blocks plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Blocks goodlayers-blocks allows Reflected XSS.This issue affects Goodlayers Blocks: from n/a through <= 1.0.1.

    GoodLayers Goodlayers Blocks