Magepeopleteam
Vulnerability activity for Magepeopleteam: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 4.3MediumOct 28, 2026Magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce Auth bypass / access controlCVE-2026-111213The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, thereby
- 6.4MediumOct 28, 2026Magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce XSSCVE-2026-109590The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticate
- 7.2HighOct 28, 2026Magepeopleteam Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar Privilege escalationCVE-2026-109381The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop
- 7.2HighAug 13, 2026Magepeopleteam Car Rental Manager DeserializationCVE-2026-27380Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
- 7.5HighAug 13, 2026Magepeopleteam Taxi Booking Manager for WooCommerce Auth bypass / access controlCVE-2026-27345Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
- 5.3MediumJun 26, 2026Magepeopleteam Booking and Rental Manager Auth bypass / access controlCVE-2026-57660Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
Top products
- Travelly – Tour & Travel Booking Manager for WooCommerce2 CVEs in the last year
- Taxi Booking Manager for WooCommerce1 CVE in the last year
- Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar1 CVE in the last year
- Car Rental Manager1 CVE in the last year
- Booking and Rental Manager1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.