Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Tour Booking Manager - Security Vulnerability (CVE-2026-120841)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
PLUGIN
Tour Booking Manager
CVE-2026-120841
Risk Score
Threat Entry
Updated 2026-11-07
Tour Booking Manager - Security Vulnerability (CVE-2026-120839)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
PLUGIN
Tour Booking Manager
CVE-2026-120839
Risk Score
Threat Entry
Updated 2026-11-06
Tour Booking Manager - Security Vulnerability (CVE-2026-121794)
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view stored WooCommerce payment gateway credentials — including PayPal API username, password, and signature, as well as Stripe test and live secret keys — injected verbatim into the HTML response of the tour…
PLUGIN
Tour Booking Manager
CVE-2026-121794
Risk Score
Threat Entry
Updated 2026-10-01
Tour Booking Manager - Security Vulnerability (CVE-2026-62063)
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.
PLUGIN
Tour Booking Manager
CVE-2026-62063
Risk Score
Threat Entry
Updated 2026-06-17
Tour Booking Manager - Security Vulnerability (CVE-2026-27089)
Unauthenticated Bypass Vulnerability in WpTravelly
PLUGIN
Tour Booking Manager
CVE-2026-27089
Risk Score
Threat Entry
Updated 2026-07-24
Tour Booking Manager - Broken Access Control (CVE-2026-27331)
Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5.
PLUGIN
Tour Booking Manager
CVE-2026-27331
Risk Score
Threat Entry
Updated 2026-07-20
Tour Booking Manager - Broken Access Control (CVE-2026-39565)
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through
PLUGIN
Tour Booking Manager
CVE-2026-39565
Risk Score
Threat Entry
Updated 2026-06-17
Tour Booking Manager - PHP Object Injection (CVE-2025-30892)
Deserialization of Untrusted Data vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Object Injection.This issue affects WpTravelly: from n/a through
PLUGIN
Tour Booking Manager
CVE-2025-30892
Risk Score
Threat Entry
Updated 2026-06-17
Tour Booking Manager - Path Traversal (CVE-2025-30891)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through
PLUGIN
Tour Booking Manager
CVE-2025-30891
Risk Score
Threat Entry
Updated 2026-06-17
Tour Booking Manager - Broken Access Control (CVE-2025-22737)
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through
PLUGIN
Tour Booking Manager
CVE-2025-22737
Risk Score
Threat Entry
Updated 2026-06-17
Tour Booking Manager - Cross-Site Request Forgery (CSRF) (CVE-2024-0434)
The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to create and publish new place posts. This function is also vulnerable to CSRF.
PLUGIN
Tour Booking Manager
CVE-2024-0434
Risk Score