CVE-2024-12272 WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion

The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several widgets. This makes it possible for authenticated attackers, with...

WordPress plugin WP Travel Engine 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-17524 · WordPress · Wp Travel Engine – Elementor Widgets

Name of the Vulnerable Software and Affected Versions: WP Travel Engine – Elementor Widgets versions up to, and including, 1.3.7 Description: The WP Travel Engine – Elementor Widgets plugin for WordPress is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, wi...

CVE-2024-12272: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several widgets. This makes it possible for authenticated attackers, with...

WordPress WP Travel Engine plugin <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Webbernaut in WordPress Plugin WP Travel Engine versions = 1.3.7...

CVE-2024-10606

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpteonboardsavefunctioncallback function in all versions up to, and including, 6.2.1. This makes it possible for...

CVE-2024-10606

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpteonboardsavefunctioncallback function in all versions up to, and including, 6.2.1. This makes it possible for...

CVE-2024-10606 WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpteonboardsavefunctioncallback function in all versions up to, and including, 6.2.1. This makes it possible for...

CVE-2024-10606 WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpteonboardsavefunctioncallback function in all versions up to, and including, 6.2.1. This makes it possible for...

CVE-2024-10606: Missing Authorization

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpteonboardsavefunctioncallback function in all versions up to, and including, 6.2.1. This makes it possible for...

WordPress plugin WP Travel Engine 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress WP Travel Engine plugin <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Contributor+ Plugin Settings Update vulnerability discovered by Noah Stead TurtleBurg in WordPress Plugin WP Travel Engine versions = 6.2.1...

WordPress WP Travel Engine Plugin <= 6.2.1 is vulnerable to Broken Access Control

Software WP Travel Engine Type Plugin Vulnerable versions = 6.2.1 Fixed in 6.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10606 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e46e3ce94c1a Credits Noah Stead TurtleBurg Requir...

CVE-2024-37944

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1...

CVE-2024-37944

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1...

CVE-2024-37944 WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1...

CVE-2024-37944

CVE-2024-37944 refers to a Stored XSS in WP Travel Engine (Tour Booking Plugin) affecting WP Travel Engine versions n/a–5.9.1. Root cause: improper neutralization during web page generation. Impact per sources is Cross-Site Scripting via stored input; exploitation would occur in authenticated con...

PT-2024-27849 · WordPress · Wp Travel Engine

Name of the Vulnerable Software and Affected Versions: WP Travel Engine versions n/a through 5.9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For WP...

CVE-2024-37944: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1...

WordPress WP Travel Engine plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin WP Travel Engine versions = 5.9.1...