Skip to content
OpenAdvisories

Vendor

MagePeople Team

71 known vulnerabilities.

Products

Booking and Rental Manager 16 WpEvently 13 Bus Ticket Booking with Seat Reservation 6 Taxi Booking Manager for WooCommerce 6 WpTravelly 6 Event Manager and Tickets Selling Plugin for WooCommerce 3 WpBookingly 3 Car Rental Manager 3 Travelly – Tour & Travel Booking Manager for WooCommerce 3 Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar 2 Booking and Rental Manager for Bike 1 E-cab Taxi Booking Manager for Woocommerce 1 Multipurpose Ticket Booking Manager 1 Deposits and Partial Payments for WooCommerce 1 Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin 1 WpBusTicketly 1 Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment 1 Event Manager for WooCommerce 1 Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution 1 Event Booking Manager for WooCommerce 1
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • High 7.2
    CVE-2026-109381

    Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

    The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an att…

    MagePeople Team Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar Web / CMS
  • High 8.8
    CVE-2026-78257

    WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

    MagePeople Team Booking and Rental Manager
  • High 7.2
    CVE-2026-27380

    WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

    Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

    MagePeople Team Car Rental Manager
  • High 7.5
    CVE-2026-27345

    WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

    MagePeople Team Taxi Booking Manager for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-59532

    WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

    Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.

    MagePeople Team Booking and Rental Manager
  • High 7.1
    CVE-2026-25361

    WordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.

    MagePeople Team WpEvently
  • High 7.5
    CVE-2026-32384

    WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2…

    MagePeople Team WpBookingly
  • High 8.8
    CVE-2025-69328

    WordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.9.

    MagePeople Team Booking and Rental Manager
  • High 8.8
    CVE-2026-24954

    WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.

    MagePeople Team WpEvently
  • High 8.8
    CVE-2025-64266

    WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.

    MagePeople Team Booking and Rental Manager
  • High 7.1
    CVE-2025-49904

    WordPress Booking and Rental Manager plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Reflected XSS.This issue affects Booking and Rental Manager: from…

    MagePeople Team Booking and Rental Manager
  • High 8.8
    CVE-2025-54742

    WordPress WpEvently Plugin <= 4.4.8 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 4.4.8.

    MagePeople Team WpEvently
  • High 7.5
    CVE-2025-27011

    WordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows PHP Local File Inclusion.This issue affects Bo…

    MagePeople Team Booking and Rental Manager
  • High 8.8
    CVE-2025-32145

    WordPress WpEvently plugin <= 4.3.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 4.3.6.

    MagePeople Team WpEvently
  • High 8.8
    CVE-2025-30892

    WordPress WpTravelly Plugin <= 1.8.7 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Object Injection.This issue affects WpTravelly: from n/a through <= 1.8.7.

    MagePeople Team WpTravelly
  • High 7.5
    CVE-2025-30895

    WordPress WpEvently Plugin <= 4.2.9 - PHP Object Injection vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently mage-eventpress allows PHP Local File Inclusion.This issue affects WpEvently: from n/a through <= 4.2.9.

    MagePeople Team WpEvently
  • High 8.8
    CVE-2025-30891

    WordPress WpTravelly Plugin <= 1.8.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through <= 1.8.7.

    MagePeople Team WpTravelly
  • High 8.8
    CVE-2025-26921

    WordPress Booking and Rental Manager Plugin <= 2.2.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.

    MagePeople Team Booking and Rental Manager
  • High 8.8
    CVE-2025-24661

    WordPress Taxi Booking Manager for WooCommerce plugin <= 1.1.8 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.

    MagePeople Team Taxi Booking Manager for WooCommerce Web / CMS
  • High 7.5
    CVE-2024-43212

    WordPress WpTravelly plugin <= 1.7.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MagePeople Team WpTravelly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through 1.7.7.

    MagePeople Team WpTravelly
  • High 8.2
    CVE-2024-24796

    WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plug…

    MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin Web / CMS
  • High 7.1
    CVE-2023-30496

    WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.

    MagePeople Team WpBusTicketly