travelly_tour_travel_booking_manager_for_woocommerce vulnerabilities
CVEs whose affected-version data names the travelly_tour_travel_booking_manager_for_woocommerce package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-109590Medium· 6.4Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to…
▾ Sunlitmagepeopleteam · Travelly – Tour & Travel Booking Manager for WooCommerceEPSS 0.24%via CVEORG
CVE-2026-111213Medium· 4.3Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorize…
▾ Sunlitmagepeopleteam · Travelly – Tour & Travel Booking Manager for WooCommerceEPSS 0.22%via CVEORG