Software intelligence
Important: Wp Travel appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works
Tracked advisories
11
Latest advisory
4 August 2026
CISA KEV matches
0
In this WordPress feed
WordPress slug
wp-travel
Plugin
This catalog lists 11 known advisories affecting Wp Travel. The most recent was published on 4 August 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 4 August 2026
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 30 July 2026
Travel <= 11.7.0 - Missing Authorization
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 29 June 2026
Known Wp Travel advisories published by month.
CVE-2026-13143 · Published 4 August 2026
Affected versions: < 11.8.1
CVE-2026-13145 · Published 30 July 2026
Affected versions: < 11.8.1
CVE-2026-11868 · Published 29 June 2026
Affected versions: ≤ 11.7.0
CVE-2026-45218 · Published 9 May 2026
Affected versions: ≤ 11.4.0
CVE-2026-24568 · Published 21 January 2026
Affected versions: ≤ 11.1.0
CVE-2025-22691 · Published 31 January 2025
Affected versions: ≤ 10.1.3
CVE-2024-12067 · Published 8 January 2025
Affected versions: ≤ 10.0.0
CVE-2024-53813 · Published 2 December 2024
Affected versions: ≤ 9.6.0
CVE-2024-44039 · Published 23 September 2024
Affected versions: ≤ 9.3.1
CVE-2023-47224 · Published 3 November 2023
Affected versions: ≤ 7.7.0
CVE-2021-4389 · Published 1 March 2021
Affected versions: ≤ 4.4.6
SiteRespond Defence matches your installed Wp Travel version against this catalog when the Defence plugin is connected to your WordPress site.