{"schema_version":1,"title":"WP Travel Engine vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in WP Travel Engine: 0 in the last 7 days and 3 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-16737, was published on 12 August 2026.","url":"https://junglewise.ai/threats/technologies/wp-travel-engine","json_url":"https://junglewise.ai/threats/technologies/wp-travel-engine.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/wp-travel-engine","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":6,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":3,"last_365_days":6},"latest":[{"cve":"CVE-2026-16737","cvss":5.3,"epss":0.0032,"slug":"cve-2026-16737-wp-travel-engine-unauthenticated-idor-in-booking-cart-actions","title":"WP Travel Engine unauthenticated IDOR in booking cart actions","severity":"medium","exploited":false,"published_at":"2026-08-12T06:19:10.733+00:00","url":"https://junglewise.ai/threats/cve-2026-16737-wp-travel-engine-unauthenticated-idor-in-booking-cart-actions"},{"cve":"CVE-2026-12500","cvss":5.3,"slug":"cve-2026-12500-wp-travel-engine-missing-authorization-in-difficulty-level-update","title":"WP Travel Engine missing authorization in difficulty level update","severity":"info","exploited":false,"published_at":"2026-07-30T06:24:58.553+00:00","url":"https://junglewise.ai/threats/cve-2026-12500-wp-travel-engine-missing-authorization-in-difficulty-level-update"},{"cve":"CVE-2026-10834","cvss":6.5,"slug":"cve-2026-10834-wp-travel-engine-arbitrary-file-move-via-user-profile-image","title":"WP Travel Engine arbitrary file move via user_profile_image","severity":"info","exploited":false,"published_at":"2026-07-07T06:16:21.637+00:00","url":"https://junglewise.ai/threats/cve-2026-10834-wp-travel-engine-arbitrary-file-move-via-user-profile-image"},{"cve":"CVE-2026-49770","cvss":9.8,"slug":"cve-2026-49770-wp-travel-engine-php-object-injection","title":"WP Travel Engine PHP object injection","severity":"critical","exploited":false,"published_at":"2026-06-15T21:17:22.057+00:00","url":"https://junglewise.ai/threats/cve-2026-49770-wp-travel-engine-php-object-injection"},{"cve":"CVE-2026-49078","cvss":7.5,"slug":"cve-2026-49078-wp-travel-engine-improper-input-validation-in-wordpress-plugin","title":"WP Travel Engine improper input validation in WordPress plugin","severity":"high","exploited":false,"published_at":"2026-06-15T21:17:19.88+00:00","url":"https://junglewise.ai/threats/cve-2026-49078-wp-travel-engine-improper-input-validation-in-wordpress-plugin"},{"cve":"CVE-2026-2437","cvss":6.4,"epss":0.0016,"slug":"cve-2026-2437-wp-travel-engine-stored-xss-in-wte-trip-tax-shortcode","title":"WP Travel Engine Stored XSS in wte_trip_tax shortcode","severity":"medium","exploited":false,"published_at":"2026-04-04T09:16:20.003+00:00","url":"https://junglewise.ai/threats/cve-2026-2437-wp-travel-engine-stored-xss-in-wte-trip-tax-shortcode"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"WP Travel Engine","slug":"wp-travel-engine","vendor":{"name":"WP Travel Engine","slug":"wp-travel-engine","url":"https://junglewise.ai/threats/vendors/wp-travel-engine"},"aliases":[],"category":"library","homepage":"https://wptravelengine.com/","repo_url":"https://github.com/WPTravelEngine/wp-travel-engine","description":"WP Travel Engine is a WordPress plugin designed for creating and managing travel booking websites and tour packages.","url":"https://junglewise.ai/threats/technologies/wp-travel-engine"},"most_severe":[{"cve":"CVE-2026-49770","cvss":9.8,"slug":"cve-2026-49770-wp-travel-engine-php-object-injection","title":"WP Travel Engine PHP object injection","severity":"critical","exploited":false,"published_at":"2026-06-15T21:17:22.057+00:00","url":"https://junglewise.ai/threats/cve-2026-49770-wp-travel-engine-php-object-injection"},{"cve":"CVE-2026-49078","cvss":7.5,"slug":"cve-2026-49078-wp-travel-engine-improper-input-validation-in-wordpress-plugin","title":"WP Travel Engine improper input validation in WordPress plugin","severity":"high","exploited":false,"published_at":"2026-06-15T21:17:19.88+00:00","url":"https://junglewise.ai/threats/cve-2026-49078-wp-travel-engine-improper-input-validation-in-wordpress-plugin"},{"cve":"CVE-2026-2437","cvss":6.4,"epss":0.0016,"slug":"cve-2026-2437-wp-travel-engine-stored-xss-in-wte-trip-tax-shortcode","title":"WP Travel Engine Stored XSS in wte_trip_tax shortcode","severity":"medium","exploited":false,"published_at":"2026-04-04T09:16:20.003+00:00","url":"https://junglewise.ai/threats/cve-2026-2437-wp-travel-engine-stored-xss-in-wte-trip-tax-shortcode"},{"cve":"CVE-2026-16737","cvss":5.3,"epss":0.0032,"slug":"cve-2026-16737-wp-travel-engine-unauthenticated-idor-in-booking-cart-actions","title":"WP Travel Engine unauthenticated IDOR in booking cart actions","severity":"medium","exploited":false,"published_at":"2026-08-12T06:19:10.733+00:00","url":"https://junglewise.ai/threats/cve-2026-16737-wp-travel-engine-unauthenticated-idor-in-booking-cart-actions"},{"cve":"CVE-2026-10834","cvss":6.5,"slug":"cve-2026-10834-wp-travel-engine-arbitrary-file-move-via-user-profile-image","title":"WP Travel Engine arbitrary file move via user_profile_image","severity":"info","exploited":false,"published_at":"2026-07-07T06:16:21.637+00:00","url":"https://junglewise.ai/threats/cve-2026-10834-wp-travel-engine-arbitrary-file-move-via-user-profile-image"},{"cve":"CVE-2026-12500","cvss":5.3,"slug":"cve-2026-12500-wp-travel-engine-missing-authorization-in-difficulty-level-update","title":"WP Travel Engine missing authorization in difficulty level update","severity":"info","exploited":false,"published_at":"2026-07-30T06:24:58.553+00:00","url":"https://junglewise.ai/threats/cve-2026-12500-wp-travel-engine-missing-authorization-in-difficulty-level-update"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}