CVE-2026-13144

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

WordPress Quentn WP plugin < 1.2.15 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Quentn WP versions 1.2.15...

EUVD-2026-74715

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

CVE-2026-84113

The Quentn WP WordPress plugin, in versions prior to 1.2.15 , contains a vulnerability where it fails to properly sanitise and escape parameters before utilizing them in an SQL query. This flaw allows users with high privileges, such as administrators , to perform SQL injection attacks. Specifica...

CVE-2026-84113 Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

CVE-2026-84113 Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

CVE-2026-84068 Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection...

CVE-2026-84068 Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection...

EUVD-2026-74714

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection...

CVE-2026-84068

The Quentn WP WordPress plugin (versions 1.2.13-1.2.14 ) is vulnerable to an unauthenticated SQL injection flaw. The root cause is the inadequate escaping of the 'qntn_wp' request parameter before it is used in an unprepared SQL query. This allows an unauthenticated attacker to extract arbitrary ...

CVE-2026-18042 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

EUVD-2026-74702

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

CVE-2026-18042

The WP Travel WordPress plugin, in versions prior to 12.0.2 , contains a vulnerability where it fails to verify if a requester is authorized to perform actions on a specific booking. This flaw exists within one of the plugin's front-end payment-message handlers . Consequently, an unauthenticated ...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation vulnerability

Unauthenticated Arbitrary Booking Cancellation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Travel versions 12.0.2...

CVE-2026-18042 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

CVE-2026-13144

The WP Travel WordPress plugin, in versions prior to 12.0.2 , contains an improper access control vulnerability within one branch of its bank-deposit handler . The flaw stems from a failure to properly verify if a requester is authorized to modify a targeted booking. This allows an unauthenticate...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset vulnerability

Unauthenticated Arbitrary Booking Payment Reset vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

EUVD-2026-74699

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...