High
CVE-2026-9231
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 44
Reset filters
Medium
CVE-2026-81796
WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.3 - Missing Authorization
Medium
CVE-2026-13146
Travel <= 12.0.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-13144
Travel <= 12.0.1 - Missing Authorization
Medium
CVE-2026-18042
Travel <= 12.0.1 - Missing Authorization
High
CVE-2026-17087
WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter
Medium
CVE-2026-16737
Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification
Medium
CVE-2026-12500
WP Travel Engine – Tour Booking Plugin – Tour Operator Software < 6.8.2 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2026-13143
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-13145
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-12501
Travel Engine <= 6.8.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-11868
Travel <= 11.7.0 - Missing Authorization
High
CVE-2026-54808
WP Travel Gutenberg Blocks <= 3.9.4 - Unauthenticated SQL Injection
Medium
CVE-2026-10834
Travel Engine <= 6.8.0 - Authenticated (Subscriber+) Arbitrary Media File Move
Medium
CVE-2026-49078
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.10 - Missing Authorization
High
CVE-2026-49770
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.12 - Unauthenticated PHP Object Injection
Critical
CVE-2026-4290
WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators
Medium
CVE-2026-45218
WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-2437
WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode
Medium
CVE-2026-24568
Travel <= 11.1.0 - Missing Authorization
Medium
CVE-2025-62063
WP Travel Gutenberg Blocks <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-7634
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
Critical
CVE-2025-7526
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
High
CVE-2025-53207
WP Travel Gutenberg Blocks <= 3.9.0 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.