Skip to content
OpenAdvisories

Vendor

WP Travel Engine

21 known vulnerabilities.

Products

WP Travel Engine 10 WP Travel Engine – Tour Booking Plugin – Tour Operator Software 7 Travel Monster 2 Travel Booking 1 WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-2437

    WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5 due to insufficient input sanitization …

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • Medium 5.3
    CVE-2026-32486

    WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.

    WP Travel Engine Travel Booking
  • Medium 5.3
    CVE-2026-24607

    WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Monster: from n/a through <= 1.3.3.

    WP Travel Engine Travel Monster
  • Medium 6.5
    CVE-2025-59574

    WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel Engine WP Travel Engine wte-elementor-widgets allows Stored XSS.This issue affects WP Travel Engine: from n/a through <= 1.4.2.

    WP Travel Engine WP Travel Engine
  • Medium 4.3
    CVE-2024-37272

    WordPress Travel Monster theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wptravelengine Travel Monster travel-monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through <= 1.1.2.

    WP Travel Engine Travel Monster
  • Medium 4.3
    CVE-2024-10606

    WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback() function in all versions up to, and incl…

    WP Travel Engine WP Travel Engine – Tour Booking Plugin – Tour Operator Software Web / CMS
  • Medium 6.5
    CVE-2024-37944

    WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1.

    WP Travel Engine WP Travel Engine