WP Travel — Vulnerabilities & Security Advisories 9

WP Travel is a WordPress plugin designed for travel agencies to manage tours, bookings, and itineraries. Historically, it has been susceptible to multiple remote code execution (RCE), cross-site scripting (XSS), and privilege escalation vulnerabilities, often stemming from insufficient input validation and improper access controls. With nine CVEs recorded, these issues have allowed attackers to execute arbitrary code, steal session cookies, and gain elevated privileges. Notable incidents include flaws in the booking system that enabled unauthorized access to customer data and tour modifications. The plugin's frequent updates suggest ongoing security challenges, emphasizing the need for proper hardening and timely patching to mitigate risks.