# cve.now: Magepeopleteam

The newest entries naming Magepeopleteam as an affected vendor (up to 200), of 60 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121794](https://cve.now/CVE-2026-121794.md): Travelly \<= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit\_form\_top Handler… (CVSS 6.5)
- [CVE-2026-54850](https://cve.now/CVE-2026-54850.md): WordPress Booking and Rental Manager plugin \<= 2.8.2 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-111213](https://cve.now/CVE-2026-111213.md): Travelly \<= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter (CVSS 4.3)
- [CVE-2026-109590](https://cve.now/CVE-2026-109590.md): Travelly \<= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes (CVSS 6.4)
- [CVE-2026-109381](https://cve.now/CVE-2026-109381.md): Event Booking Manager for WooCommerce \<= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter (CVSS 7.2)
- [CVE-2026-97251](https://cve.now/CVE-2026-97251.md): WordPress Bus Ticket Booking with Seat Reservation plugin \<= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2026-27378](https://cve.now/CVE-2026-27378.md): WordPress Deposits and Partial Payments for WooCommerce plugin \<= 3.1.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-81762](https://cve.now/CVE-2026-81762.md): WordPress Booking and Rental Manager plugin \<= 2.7.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-78257](https://cve.now/CVE-2026-78257.md): WordPress Booking and Rental Manager plugin \<= 2.7.5 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-73363](https://cve.now/CVE-2026-73363.md): WordPress Taxi Booking Manager for WooCommerce plugin \< 2.0.8 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-66687](https://cve.now/CVE-2026-66687.md): WordPress WpBookingly plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-27380](https://cve.now/CVE-2026-27380.md): WordPress Car Rental Manager plugin \<= 1.3.9 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-27345](https://cve.now/CVE-2026-27345.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-17166](https://cve.now/CVE-2026-17166.md): Event Booking Manager for WooCommerce \<= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep\_save\_payment\_settings\_modal AJAX Action (CVSS 4.3)
- [CVE-2026-59532](https://cve.now/CVE-2026-59532.md): WordPress Booking and Rental Manager plugin \<= 2.7.2 - Price Manipulation vulnerability (CVSS 7.5)
- [CVE-2026-61985](https://cve.now/CVE-2026-61985.md): WordPress Car Rental Manager plugin \<= 1.3.7 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-57404](https://cve.now/CVE-2026-57404.md): WordPress Booking and Rental Manager plugin \<= 2.6.9 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-57660](https://cve.now/CVE-2026-57660.md): WordPress Booking and Rental Manager plugin \<= 2.7.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-39572](https://cve.now/CVE-2026-39572.md): WordPress Bus Ticket Booking with Seat Reservation plugin \< 5.6.5 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2026-39565](https://cve.now/CVE-2026-39565.md): WordPress WpTravelly plugin \<= 2.1.7 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-27095](https://cve.now/CVE-2026-27095.md): WordPress Bus Ticket Booking with Seat Reservation plugin \<= 5.6.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-25361](https://cve.now/CVE-2026-25361.md): WordPress WpEvently plugin \<= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-23972](https://cve.now/CVE-2026-23972.md): WordPress Booking and Rental Manager plugin \<= 2.6.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-32384](https://cve.now/CVE-2026-32384.md): WordPress WpBookingly plugin \<= 1.2.9 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-32354](https://cve.now/CVE-2026-32354.md): WordPress WpEvently plugin \< 5.1.9 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2025-69328](https://cve.now/CVE-2025-69328.md): WordPress Booking and Rental Manager plugin \<= 2.5.9 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-23549](https://cve.now/CVE-2026-23549.md): WordPress WpEvently plugin \<= 5.1.1 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-24954](https://cve.now/CVE-2026-24954.md): WordPress WpEvently plugin \<= 5.0.8 - Deserialization of untrusted data vulnerability (CVSS 8.8)
- [CVE-2026-24942](https://cve.now/CVE-2026-24942.md): WordPress WpEvently plugin \<= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-69327](https://cve.now/CVE-2025-69327.md): WordPress Car Rental Manager plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-64266](https://cve.now/CVE-2025-64266.md): WordPress Booking and Rental Manager plugin \<= 2.5.4 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-66083](https://cve.now/CVE-2025-66083.md): WordPress WpEvently plugin \<= 5.0.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-66082](https://cve.now/CVE-2025-66082.md): WordPress WpEvently plugin \<= 5.0.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-49904](https://cve.now/CVE-2025-49904.md): WordPress Booking and Rental Manager plugin \<= 2.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-54742](https://cve.now/CVE-2025-54742.md): WordPress WpEvently Plugin \<= 4.4.8 - PHP Object Injection Vulnerability (CVSS 8.8)
- [CVE-2025-54713](https://cve.now/CVE-2025-54713.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 1.3.0 - Broken Authentication vulnerability (CVSS 9.8)
- [CVE-2025-8898](https://cve.now/CVE-2025-8898.md): Taxi Booking Manager for Woocommerce | E-cab \<= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8)
- [CVE-2025-54705](https://cve.now/CVE-2025-54705.md): WordPress WpEvently plugin \<= 4.4.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-5568](https://cve.now/CVE-2025-5568.md): WpEvently \<= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-47585](https://cve.now/CVE-2025-47585.md): WordPress Booking and Rental Manager plugin \<= 2.3.8 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-39390](https://cve.now/CVE-2025-39390.md): WordPress Booking and Rental Manager plugin \<= 2.3.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-39457](https://cve.now/CVE-2025-39457.md): WordPress Booking and Rental Manager plugin \<= 2.2.8 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-27011](https://cve.now/CVE-2025-27011.md): WordPress Booking and Rental Manager plugin \<= 2.2.8 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-32607](https://cve.now/CVE-2025-32607.md): WordPress WpBookingly plugin \<= 1.3.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-32145](https://cve.now/CVE-2025-32145.md): WordPress WpEvently plugin \<= 4.3.6 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-30892](https://cve.now/CVE-2025-30892.md): WordPress WpTravelly Plugin \<= 1.8.7 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-30895](https://cve.now/CVE-2025-30895.md): WordPress WpEvently Plugin \<= 4.2.9 - PHP Object Injection vulnerability (CVSS 7.5)
- [CVE-2025-30891](https://cve.now/CVE-2025-30891.md): WordPress WpTravelly Plugin \<= 1.8.7 - Local File Inclusion vulnerability (CVSS 8.8)
- [CVE-2025-30887](https://cve.now/CVE-2025-30887.md): WordPress WpEvently Plugin \<= 4.2.9 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-30839](https://cve.now/CVE-2025-30839.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-26921](https://cve.now/CVE-2025-26921.md): WordPress Booking and Rental Manager Plugin \<= 2.2.6 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-24661](https://cve.now/CVE-2025-24661.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 1.1.8 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-22720](https://cve.now/CVE-2025-22720.md): WordPress WpRently | WordPress plugin plugin \<= 2.2.1 - Broken Access Control vulnerability (CVSS 5.8)
- [CVE-2025-22737](https://cve.now/CVE-2025-22737.md): WordPress WpTravelly Plugin \<= 1.8.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-12412](https://cve.now/CVE-2024-12412.md): Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin \<= 2.2.1 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-49294](https://cve.now/CVE-2024-49294.md): WordPress WpBusTicketly plugin \<= 5.4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-49703](https://cve.now/CVE-2024-49703.md): WordPress WpEvently plugin \<= 4.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-44037](https://cve.now/CVE-2024-44037.md): WordPress Multipurpose Ticket Booking Manager plugin \<= 4.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-0434](https://cve.now/CVE-2024-0434.md): WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly \<= 1.7.1 - Missing Authorization via ttbm\_new\_place\_save (CVSS 5.3)
- [CVE-2023-4067](https://cve.now/CVE-2023-4067.md): Bus Ticket Booking with Seat Reservation \<= 5.2.3 - Reflected Cross-Site Scripting (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/magepeopleteam
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.