magepeopleteam has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 6.4 (medium). None have a confirmed exploitation report. Most affected products: Travelly – Tour & Travel Booking Manager for WooCommerce (2), Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (1), advanced-partial-payment-or-deposit-for-woocommerce (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Products
- Travelly – Tour & Travel Booking Manager for WooCommerce 2
- Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar 1
- advanced-partial-payment-or-deposit-for-woocommerce 1
- bus-ticket-booking-with-seat-reservation 1
Worst active — by depth score
CVE-2026-109381High· 7.2Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter40CVE-2026-97251Medium· 6.5Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.36CVE-2026-109590Medium· 6.4Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes35CVE-2026-27378Medium· 5.3Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.29CVE-2026-111213Medium· 4.3Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter24
magepeopleteam vulnerabilities
CVEs affecting magepeopleteam, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-109381High· 7.2Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_o…
CVE-2026-109590Medium· 6.4Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to…
CVE-2026-111213Medium· 4.3Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorize…
CVE-2026-97251Medium· 6.5Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.
CVE-2026-27378Medium· 5.3Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.