WordPress security by component

WP Travel

Plugin description

WP Travel is a WordPress component with 9 published CVE records in this archive. The latest tracked vulnerability was published Jul 20, 2026; the highest CVE/CNA score is 7.7.

Plugin slug: wp-travel

Latest vulnerability

CVE-2026-11868: WP Travel: A security weakness

WP Travel is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 11.7.1.

PublishedJul 20, 2026

Known safe version11.7.1

		Safe version
Jul 20, 2026	CVE-2026-11868 WP Travel: A security weakness WP Travel is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 11.7.1.	11.7.1	CVE5.3 NVDPending
May 12, 2026	CVE-2026-45218 WP Travel: SQL injection WP Travel is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 11.4.0.	11.5.0	CVE7.7 NVDPending
Jan 23, 2026	CVE-2026-24568 WP Travel: A security weakness WP Travel is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Feb 03, 2025	CVE-2025-22691 WP Travel: SQL injection WP Travel is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.6 NVDPending
Jan 09, 2025	CVE-2024-12067 WP Travel – Ultimate Travel Booking System, Tour Management Engine: SQL injection WP Travel – Ultimate Travel Booking System, Tour Management Engine is affected by SQL injection. Exploitation requires at least subscriber-level access. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE6.5 NVDPending
Jan 02, 2025	CVE-2023-47224 WP Travel: A security weakness WP Travel is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVDPending
Dec 06, 2024	CVE-2024-53813 WP Travel: A security weakness WP Travel is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
Oct 06, 2024	CVE-2024-44039 WP Travel: Cross-site scripting WP Travel is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVDPending
Jul 01, 2023	CVE-2021-4389 WP Travel: Cross-site request forgery WP Travel is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVDPending