CVE-2026-2437
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Stored XSS vulnerability in the WP Travel Engine plugin for WordPress (versions up to 6.7.5). Insufficient input sanitization and output escaping in the 'wte_trip_tax' shortcode allow authenticated attackers (contributor level and above) to inject malicious JavaScript.
Risk Assessment
An attacker can inject scripts that execute whenever the page is viewed, potentially leading to session theft or redirects.
Recommendation
Update the WP Travel Engine plugin to version 6.7.6 or later.
Other vulnerabilities in WP Travel Engine
See all- CVE-2026-49770Critical
There is an unauthenticated PHP Object Injection vulnerability in WP Travel Engine versions up to 6.7.12.
- CVE-2026-9231High
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server.
- CVE-2026-17087High
The WP Travel Engine plugin for WordPress up to version 6.8.4 is vulnerable to authorization bypass, allowing unauthenticated attackers to view private booking billing details, including the customer's first name, last name, email, street address, city, and phone number, by binding an arbitrary booking ID to the attacker's session.
- CVE-2026-16737Medium
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
- CVE-2026-12501Medium
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid. This allows unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.
- CVE-2026-12500High
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a plugin option. Unauthenticated users can overwrite a site-wide WP Travel Engine option (the public nonce is served to anonymous visitors).
- CVE-2026-10834Medium
The WP Travel Engine WordPress plugin before version 6.8.1 fails to properly validate the source of a user-supplied profile image path before moving the file. This allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path.
- CVE-2026-49078High
There is an unauthenticated vulnerability type in WP Travel Engine versions up to 6.7.10 that could be exploited by attackers.
Original NVD description (English source)
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS