WordPress security by component

WpTravelly

Plugin description

WpTravelly is a WordPress component with 9 published CVE records in this archive. The latest tracked vulnerability was published Jun 15, 2026; the highest CVE/CNA score is 8.8.

Plugin slug: tour-booking-manager

Latest vulnerability

CVE-2026-27089: WpTravelly: A security weakness

WpTravelly is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.1.7.

PublishedJun 15, 2026

Known safe version2.1.8

		Safe version
Jun 15, 2026	CVE-2026-27089 WpTravelly: A security weakness WpTravelly is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.1.7.	2.1.8	CVE7.5 NVDPending
May 26, 2026	CVE-2026-27331 WpTravelly: A security weakness WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.1.5.	2.1.6	CVE6.3 NVDPending
Apr 08, 2026	CVE-2026-39565 WpTravelly: A security weakness WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.1.7.	2.1.8	CVE4.3 NVDPending
Apr 01, 2025	CVE-2025-30892 WpTravelly: Code execution WpTravelly is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8 NVDPending
Mar 27, 2025	CVE-2025-30891 WpTravelly: Filesystem traversal WpTravelly is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE8.8 NVDPending
Jan 15, 2025	CVE-2025-22737 WpTravelly: A security weakness WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Nov 01, 2024	CVE-2024-43212 WpTravelly: A security weakness WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVDPending
May 29, 2024	CVE-2024-0434 WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly: Cross-site request forgery WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.3 NVDPending
Apr 15, 2024	CVE-2024-32450 WpTravelly: Cross-site request forgery WpTravelly is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVDPending