CVE Intelligence

Magepeopleteam vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Magepeopleteam products: 28 record(s), with severity, exploitation and fixes.

Booking and Rental Manager 9WpEvently 7Car Rental Manager 3WpBookingly 2Bus Ticket Booking with Seat Reservation 2Taxi Booking Manager for WooCommerce 2WpTravelly 1Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar 1Deposits and Partial Payments for WooCommerce 1

Exploited only (KEV) →

CVE-2026-27378 Medium · 5.3 CWE-862 Sep 11, 2026
WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
CVE-2026-81762 Medium · 6.5 CWE-862 Aug 31, 2026
WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
CVE-2026-78257 High · 8.8 CWE-502 Aug 27, 2026
WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
CVE-2026-73363 Medium · 6.5 CWE-862 Aug 19, 2026
WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.
CVE-2026-66687 Medium · 6.5 CWE-79 Aug 13, 2026
WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
CVE-2026-27380 High · 7.2 CWE-502 Aug 13, 2026
WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability
Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
CVE-2026-27345 High · 7.5 CWE-862 Aug 13, 2026
WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
CVE-2026-17166 Medium · 4.3 CWE-862 Jul 28, 2026
Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.
CVE-2026-59532 High · 7.5 CWE-1284 Jul 27, 2026
WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability
Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.
CVE-2026-61985 Medium · 5.3 CWE-862 Jul 13, 2026
WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.
CVE-2026-57404 Medium · 6.5 CWE-862 Jul 13, 2026
WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.
CVE-2026-57660 Medium · 5.3 CWE-862 Jun 26, 2026
WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
CVE-2026-39572 Medium · 4.3 CWE-497 Apr 8, 2026
WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.5 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.
CVE-2026-39565 Medium · 4.3 CWE-862 Apr 8, 2026
WordPress WpTravelly plugin <= 2.1.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.
CVE-2026-27095 Critical · 9.8 CWE-502 Mar 25, 2026
WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.
CVE-2026-25361 High · 7.1 CWE-79 Mar 25, 2026
WordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.
CVE-2026-23972 Medium · 6.5 CWE-862 Mar 25, 2026
WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.
CVE-2026-32384 High · 7.5 CWE-98 Mar 13, 2026
WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.
CVE-2026-32354 Medium · 5.3 CWE-201 Mar 13, 2026
WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through < 5.1.9.
CVE-2025-69328 High · 8.8 CWE-502 Feb 20, 2026
WordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.9.
CVE-2026-23549 Critical · 9.8 CWE-502 Feb 19, 2026
WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
CVE-2026-24954 High · 8.8 CWE-502 Feb 3, 2026
WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.
CVE-2026-24942 Medium · 4.3 CWE-352 Feb 3, 2026
WordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam WpEvently mage-eventpress allows Cross Site Request Forgery.This issue affects WpEvently: from n/a through <= 5.1.1.
CVE-2025-69327 Medium · 4.3 CWE-862 Jan 6, 2026
WordPress Car Rental Manager plugin <= 1.0.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.0.9.
CVE-2025-64266 High · 8.8 CWE-502 Dec 18, 2025
WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.