Magepeopleteam vulnerabilities, page 2
55 vulnerabilities
Known vulnerabilities in Magepeopleteam products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.
CVE-2025-30839magepeopleteamtaxi booking manager for woocommerce+1
EPSS score0.50%
Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.2.1.CVE-2025-30887magepeopleteamwpevently+1EPSS score0.37%
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.2.9.CVE-2025-30895magepeopleteamwpevently+1EPSS score0.83%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently mage-eventpress allows PHP Local File Inclusion.This issue affects WpEvently: from n/a through <= 4.2.9.CVE-2025-30891magepeopleteamwptravelly+1EPSS score0.69%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through <= 1.8.7.CVE-2025-30892magepeopleteamwptravelly+1EPSS score0.66%
Deserialization of Untrusted Data vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Object Injection.This issue affects WpTravelly: from n/a through <= 1.8.7.CVE-2025-8898magepeopleteame-cab taxi booking manager for woocommerce+1EPSS score0.51%
The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin not properly validating a user's capabilities prior to updating a plugin setting or their identity prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. CVE-2025-54713 is likely a duplicate of this issue.CVE-2024-0434magepeopleteamtravelly – tour & travel booking manager for woocommerce | tour & hotel booking solution+1EPSS score0.39%
The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to create and publish new place posts. This function is also vulnerable to CSRF.CVE-2024-44037magepeopleteammultipurpose ticket booking manager+1EPSS score0.27%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Multipurpose Ticket Booking Manager bus-booking-manager allows Stored XSS.This issue affects Multipurpose Ticket Booking Manager: from n/a through <= 4.2.2.CVE-2024-49294magepeopleteambus ticket booking with seat reservation+1EPSS score0.19%
Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Cross Site Request Forgery.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.4.3.CVE-2024-49703magepeopleteamwpevently+1EPSS score0.26%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress.This issue affects WpEvently: from n/a through <= 4.2.5.CVE-2024-12412magepeopleteambooking and rental manager for bike | car | resort | appointment | dress | equipment+1EPSS score0.36%
The Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘active_tab’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-73363magepeopleteamtaxi booking manager for woocommerce+1EPSS score0.30%
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.CVE-2026-61985magepeopleteamcar rental manager+1EPSS score0.29%
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.CVE-2026-59532magepeopleteambooking and rental manager+1EPSS score0.37%
Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.CVE-2026-39565magepeopleteamwptravelly+1EPSS score0.23%
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.CVE-2026-39572magepeopleteambus ticket booking with seat reservation+1EPSS score0.26%
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.CVE-2026-17166magepeopleteamevent booking manager for woocommerce – sell tickets, event registration, rsvp & event calendar+1EPSS score0.40%
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.CVE-2026-25361magepeopleteamwpevently+1EPSS score0.18%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.CVE-2026-66687magepeopleteamwpbookingly+1EPSS score0.22%
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.CVE-2026-27345magepeopleteamtaxi booking manager for woocommerce+1EPSS score0.35%
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.