Travel Booking
by WordPress
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-11912 | Hig | 0.49 | 7.5 | 0.00 | Dec 18, 2024 | The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on… | ||
| CVE-2024-11926 | Med | 0.42 | 6.5 | 0.00 | Dec 18, 2024 | The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental', 'st_delete_order_item', '_st_partner_approve_booking', 'save_order_item', and… | ||
| CVE-2026-32486 | Med | 0.34 | 5.3 | 0.00 | Mar 13, 2026 | Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9. | ||
| CVE-2026-56059 | Cri | 0.00 | 9.9 | 0.00 | Jun 26, 2026 | Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions. |
- risk 0.49cvss 7.5epss 0.00
The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
- risk 0.42cvss 6.5epss 0.00
The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental', 'st_delete_order_item', '_st_partner_approve_booking', 'save_order_item', and…
- risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.
- risk 0.00cvss 9.9epss 0.00
Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.