Skip to content
OpenAdvisories

Vendor

WP Travel

14 known vulnerabilities.

Products

WP Travel 6 WP Travel Gutenberg Blocks 5 WP Travel – Ultimate Travel Booking System, Tour Management Engine 2 WP Travel Pro 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-24568

    WordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 11.1.0.

    WP Travel WP Travel
  • Medium 6.5
    CVE-2025-62063

    WordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.9.2.

    WP Travel WP Travel Gutenberg Blocks
  • Medium 6.5
    CVE-2024-12067

    WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection

    The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' parameter of the 'wptravel_get_booking_data' function in all versions up to, and including, 10.0.0 due to in…

    WP Travel WP Travel – Ultimate Travel Booking System, Tour Management Engine Web / CMS
  • Medium 6.5
    CVE-2024-53813

    WordPress WP Travel plugin <= 9.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 9.6.0.

    WP Travel WP Travel
  • Medium 5.9
    CVE-2024-44039

    WordPress WP Travel plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel wp-travel allows Stored XSS.This issue affects WP Travel: from n/a through <= 9.3.1.

    WP Travel WP Travel
  • Medium 6.5
    CVE-2024-47627

    WordPress WP Travel Gutenberg Blocks plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.6.0.

    WP Travel WP Travel Gutenberg Blocks
  • Medium 6.5
    CVE-2024-43284

    WordPress WP Travel Gutenberg Blocks plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through 3.5.1.

    WP Travel WP Travel Gutenberg Blocks
  • Medium 4.3
    CVE-2021-4389

    WP Travel <= 4.4.6 - Cross-Site Request Forgery Bypass

    The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect nonce validation on the save_meta_data() function. This makes it possible for unauthenticated attackers…

    WP Travel WP Travel – Ultimate Travel Booking System, Tour Management Engine Web / CMS