Wptravelengine
Wptravelengine WP Travel Engine: vulnerabilities and CVEs
Wptravelengine WP Travel Engine has 23 published vulnerabilities, 11 of them in the last 12 months. 5 are rated critical and 0 are listed by CISA as actively exploited.
CVEs23
Last 12 months11
Critical5
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9231 | High (7.5) | 0.58% | — | Sep 22, 2026 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it… |
| CVE-2026-17087 | High (7.5) | 0.69% | — | Aug 16, 2026 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly… |
| CVE-2026-16737 | Medium (5.3) | 0.32% | — | Aug 12, 2026 | The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing… |
| CVE-2026-12501 | Medium (5.3) | 0.16% | — | Aug 6, 2026 | The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total,… |
| CVE-2026-12500 | High (7.5) | 0.36% | — | Jul 30, 2026 | The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite… |
| CVE-2026-10834 | Medium (4.6) | 0.24% | — | Jul 7, 2026 | The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above… |
| CVE-2026-49770 | Critical (9.8) | 0.56% | — | Jun 15, 2026 | Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions. |
| CVE-2026-49078 | High (7.5) | 0.37% | — | Jun 15, 2026 | Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions. |
| CVE-2026-2437 | Medium (6.4) | 0.16% | — | Apr 4, 2026 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5… |
| CVE-2025-7634 | Critical (9.8) | 0.80% | — | Oct 9, 2025 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible… |
| CVE-2025-7526 | Critical (9.8) | 0.92% | — | Oct 9, 2025 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image… |
| CVE-2025-59574 | Medium (6.5) | 0.17% | — | Sep 22, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel Engine WP Travel Engine wte-elementor-widgets allows Stored XSS.This issue affects WP Travel Engine: from… |
| CVE-2025-5282 | High (7.5) | 0.30% | — | Jun 13, 2025 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up… |
| CVE-2025-49308 | High (7.5) | 0.74% | — | Jun 6, 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue… |
| CVE-2025-30870 | Critical (9.8) | 0.78% | — | Apr 1, 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue… |
| CVE-2025-30871 | High (7.5) | 0.98% | — | Mar 27, 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue… |
| CVE-2024-12272 | High (8.8) | 0.77% | — | Dec 25, 2024 | The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several… |
| CVE-2024-10606 | Medium (4.3) | 0.30% | — | Nov 23, 2024 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback()… |
| CVE-2024-37944 | Medium (5.4) | 0.28% | — | Jul 20, 2024 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1. |
| CVE-2024-32798 | Medium (5.3) | 0.34% | — | Jun 9, 2024 | Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0. |
| CVE-2024-30504 | High (7.2) | 0.57% | — | Mar 29, 2024 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9. |
| CVE-2024-30502 | Critical (9.8) | 2.2% | — | Mar 29, 2024 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9. |
| CVE-2021-24680 | Medium (5.4) | 0.60% | — | Jan 3, 2022 | The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.