Tour Operator
Tour Operator has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Tour Operator has a vendor fix available, so running the current release closes it.
All of these findings were reported by Francesco Carlucci. Tour Operator is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-9851LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Read the full analysisVulnerability Records
Tour Operator
Author
Ash Shaw
The Tour Operator plugin provides all the tools needed to create compelling tour listings and travel content, designed specifically for tourism and destination marketing websites. Key Features: * Custom post types for Tours, Destinations, and Accommodation. * Day-by-day itinerary blocks, Fast Facts, galleries, and maps. * Fully compatible with block themes and Full Site Editing. * Optional Wetu integration for importing structured travel data. * JSON-based field registration for clean customization. * Developer-friendly with hooks, filters, and template overrides. Official site: https://touroperator.solutions/ Related Extensions Special Offers: https://wordpress.org/plugins/tour-operator-special-offers/ Reviews: https://wordpress.org/plugins/tour-operator-reviews/ Team: https://wordpress.org/plugins/tour-operator-team/ Wetu Importer: https://wordpress.org/plugins/lsx-importer-for-wetu/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C