PT-2026-66372

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

CVE-2026-13145: Authorization Bypass Through User-Controlled Key

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

Malicious code in syf-multi-account-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0ac62a649610f098e4f31e1bfccfd5101ab1f37dbf92420a4e80321b8f7a148 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7988 Malicious code in syf-multi-account-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0ac62a649610f098e4f31e1bfccfd5101ab1f37dbf92420a4e80321b8f7a148 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...