Skip to content
OpenAdvisories

Vendor

WP Travel Engine

21 known vulnerabilities.

WP Travel Engine at a glance

Last 12 months
7
Critical · all time
4
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 1 vulnerability May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities, 1 critical Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202610
Jul 202600
Jun 202621
May 202600
Apr 202610
Mar 202610
Feb 202600
Jan 202610
Dec 202500
Nov 202500
Oct 202522
Sep 202510
Aug 202500
Jul 202500
Jun 202520
May 202500
Apr 202510
Mar 202510
Feb 202500
Jan 202510
Dec 202410

Products

WP Travel Engine 10 WP Travel Engine – Tour Booking Plugin – Tour Operator Software 7 Travel Monster 2 Travel Booking 1 WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor 1
All Critical High Medium Low Exploited only Public exploit

21 results · Feed

  • High 7.5
    CVE-2026-9231

    WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, w…

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • High 7.5
    CVE-2026-17087

    WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform a…

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • Critical 9.8
    CVE-2026-49770

    WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

    WP Travel Engine WP Travel Engine
  • High 7.5
    CVE-2026-49078

    WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

    Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.

    WP Travel Engine WP Travel Engine
  • Medium 6.4
    CVE-2026-2437

    WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5 due to insufficient input sanitization …

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • Medium 5.3
    CVE-2026-32486

    WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.

    WP Travel Engine Travel Booking
  • Medium 5.3
    CVE-2026-24607

    WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Monster: from n/a through <= 1.3.3.

    WP Travel Engine Travel Monster
  • Critical 9.8
    CVE-2025-7634

    WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include …

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • Critical 9.8
    CVE-2025-7526

    WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image function in all versions up to, and includi…

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • Medium 6.5
    CVE-2025-59574

    WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel Engine WP Travel Engine wte-elementor-widgets allows Stored XSS.This issue affects WP Travel Engine: from n/a through <= 1.4.2.

    WP Travel Engine WP Travel Engine
  • High 7.5
    CVE-2025-5282

    WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it p…

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • High 7.5
    CVE-2025-49308

    WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <…

    WP Travel Engine WP Travel Engine
  • High 8.1
    CVE-2025-30870

    WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <…

    WP Travel Engine WP Travel Engine
  • High 7.5
    CVE-2025-30871

    WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <…

    WP Travel Engine WP Travel Engine
  • Medium 4.3
    CVE-2024-37272

    WordPress Travel Monster theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wptravelengine Travel Monster travel-monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through <= 1.1.2.

    WP Travel Engine Travel Monster
  • High 8.8
    CVE-2024-12272

    WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion

    The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several widgets. This makes it possible for authe…

    WP Travel Engine WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor Web / CMS
  • Medium 4.3
    CVE-2024-10606

    WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback() function in all versions up to, and incl…

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • Medium 6.5
    CVE-2024-37944

    WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1.

    WP Travel Engine WP Travel Engine
  • High 7.5
    CVE-2024-32798

    WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability

    Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0.

    WP Travel Engine WP Travel Engine
  • High 7.6
    CVE-2024-30504

    WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

    WP Travel Engine WP Travel Engine
  • Critical 9.3
    CVE-2024-30502 Scanner template

    WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

    WP Travel Engine WP Travel Engine