Skip to content
Noroxi

Tourfic

tourfic · plugin

Known security vulnerabilities for Tourfic. Find out in seconds which version runs on your site with WP Lens.

14 known vulnerabilities

1 critical · 1 with public exploit code · latest Aug 13, 2026

Vulnerabilities

  • CVE-2025-24650

    WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

    Critical 9.1

  • CVE-2024-29136

    WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability

    High 8.8

  • CVE-2024-29135

    WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

    High 8.8

  • CVE-2026-56064

    WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability

    High 8.5

  • CVE-2026-12937

    Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter

    High 7.5

  • CVE-2026-27999

    WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2026-57395

    WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2026-57392

    WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2024-12032

    Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injectio

    Medium 6.5

  • CVE-2024-29137

    WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-29134

    WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2026-39543

    WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-8860

    Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions

    Medium 4.3

  • CVE-2024-8319

    Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions

    Medium 4.3

← Back to directory