Threat database

CVE-2026-27331 is a missing authorization vulnerability in Magepeople inc. 's WpTravelly plugin affecting versions up to 2.1.5. The flaw involves incorrectly configured access control security levels, potentially allowing users with limited privileges to perform unauthorized actions. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date. There are no known exploits in the wild at this time.

Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.

CVE-2025-66105 is a missing authorization vulnerability in Magepeople inc. 's Bus Ticket Booking with Seat Reservation software. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability affects versions before 5.6.8, but specific affected versions are not clearly enumerated. The CVSS score is 5.3, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.0.