Wptravelengine
Wptravelengine WP Travel Engine: vulnerabilidades y CVE
Wptravelengine WP Travel Engine tiene 23 vulnerabilidades publicadas, 11 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE23
Últimos 12 meses11
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-9231 | Alta (7.5) | 0.58% | — | 22 sept 2026 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it… |
| CVE-2026-17087 | Alta (7.5) | 0.69% | — | 16 ago 2026 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly… |
| CVE-2026-16737 | Media (5.3) | 0.32% | — | 12 ago 2026 | The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing… |
| CVE-2026-12501 | Media (5.3) | 0.16% | — | 6 ago 2026 | The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total,… |
| CVE-2026-12500 | Alta (7.5) | 0.36% | — | 30 jul 2026 | The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite… |
| CVE-2026-10834 | Media (4.6) | 0.24% | — | 7 jul 2026 | The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above… |
| CVE-2026-49770 | Crítica (9.8) | 0.56% | — | 15 jun 2026 | Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions. |
| CVE-2026-49078 | Alta (7.5) | 0.37% | — | 15 jun 2026 | Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions. |
| CVE-2026-2437 | Media (6.4) | 0.16% | — | 4 abr 2026 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5… |
| CVE-2025-7634 | Crítica (9.8) | 0.80% | — | 9 oct 2025 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible… |
| CVE-2025-7526 | Crítica (9.8) | 0.92% | — | 9 oct 2025 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image… |
| CVE-2025-59574 | Media (6.5) | 0.17% | — | 22 sept 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel Engine WP Travel Engine wte-elementor-widgets allows Stored XSS.This issue affects WP Travel Engine: from… |
| CVE-2025-5282 | Alta (7.5) | 0.30% | — | 13 jun 2025 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up… |
| CVE-2025-49308 | Alta (7.5) | 0.74% | — | 6 jun 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue… |
| CVE-2025-30870 | Crítica (9.8) | 0.78% | — | 1 abr 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue… |
| CVE-2025-30871 | Alta (7.5) | 0.98% | — | 27 mar 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue… |
| CVE-2024-12272 | Alta (8.8) | 0.77% | — | 25 dic 2024 | The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several… |
| CVE-2024-10606 | Media (4.3) | 0.30% | — | 23 nov 2024 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback()… |
| CVE-2024-37944 | Media (5.4) | 0.28% | — | 20 jul 2024 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1. |
| CVE-2024-32798 | Media (5.3) | 0.34% | — | 9 jun 2024 | Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0. |
| CVE-2024-30504 | Alta (7.2) | 0.57% | — | 29 mar 2024 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9. |
| CVE-2024-30502 | Crítica (9.8) | 2.2% | — | 29 mar 2024 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9. |
| CVE-2021-24680 | Media (5.4) | 0.60% | — | 3 ene 2022 | The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.