Skip to content
Noroxi

WP Travel Engine

wp-travel-engine · plugin

Known security vulnerabilities for WP Travel Engine. Find out in seconds which version runs on your site with WP Lens.

16 known vulnerabilities

5 critical · 1 with public exploit code · latest Sep 22, 2026

Vulnerabilities

  • CVE-2026-49770

    WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

    Critical 9.8

  • CVE-2025-7634

    WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion

    Critical 9.8

  • CVE-2025-7526

    WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming

    Critical 9.8

  • CVE-2025-30870

    WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

    Critical 9.8

  • CVE-2024-30502

    WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability

    Critical 9.8

  • CVE-2026-9231

    WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

    High 7.5

  • CVE-2026-17087

    WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

    High 7.5

  • CVE-2026-49078

    WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

    High 7.5

  • CVE-2025-5282

    WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

    High 7.5

  • CVE-2025-49308

    WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability

    High 7.5

  • CVE-2025-30871

    WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

    High 7.5

  • CVE-2024-30504

    WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability

    High 7.2

  • CVE-2026-2437

    WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode

    Medium 6.4

  • CVE-2024-37944

    WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-32798

    WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability

    Medium 5.3

  • CVE-2024-10606

    WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

    Medium 4.3

← Back to directory