Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2025-68042

WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Travelpayouts Wordpress
Products
Travelpayouts Wordpress
CVE-2023-5934

Travelpayouts < 1.1.13 - Settings Update via CSRF

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Travelpayouts
Products
Travelpayouts
CVE-2023-5932

Travelpayouts < 1.1.14 - Reflected XSS

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Travelpayouts
Products
Travelpayouts
CVE-2024-0337

Travelpayouts <= 1.1.15 - Open Redirect

The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Travelpayouts
Products
Travelpayouts