CVE-2026-121794

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress (versions

CVE-2026-121794 Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-118023

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

WordPress Travelly – Tour & Travel Booking Manager for WooCommerce plugin <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure vulnerability

Missing Authorization to Authenticated Contributor+ Payment Gateway Credential Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin WpTravelly versions = 2.3.11...

CVE-2026-111213

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-111213 Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-111213 Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-111598

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-111213

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 2.3.6 . The root cause is the plugin's failure to properly verify user permissions when performing actions, specifically allowing authenticate...

PT-2026-127878

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

WordPress Travelly authorization issue vulnerability

WordPress Travelly versions 2.3.6 and earlier contain an authorization issue vulnerability. This vulnerability arises from improper validation of whether a user is authorized to perform certain actions. Certified attackers with contributor or higher privileges can obtain a valid nonce from the...

WordPress Travelly cross-site scripting vulnerability

WordPress Travelly versions 2.3.6 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping of width, height, and zoom attributes in the ttbm-hotel-map shortcode. The ttbmhotelmapshortcode function concatenates thes...

CVE-2026-111213: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce: The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass…

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

WordPress Travelly – Tour & Travel Booking Manager for WooCommerce plugin <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WpTravelly versions = 2.3.6...

WordPress Travelly – Tour & Travel Booking Manager for WooCommerce plugin <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Duplication vulnerability discovered by Wordfence PRISM in WordPress Plugin WpTravelly versions = 2.3.6...

WordPress Travelly authorization issue vulnerability

WordPress Travelly versions 2.3.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control levels...

CVE-2026-27089

WPTravelly plugin for WordPress, versions

CVE-2026-27331

Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5...