Travel Monster

Travel Monster has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for Travel Monster has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Travel Monster is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

4.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Travel Monster vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-24607

Travel Monster <= 1.3.3 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records


2026-01-13 13:56	Travel Monster <= 1.3.3 - Missing Authorization Travel Monster <= 1.3.3	`CVE-2026-24607`	5.3 Medium	John P	Yes
2024-06-27 00:00	Travel Monster <= 1.1.2 - Cross-Site Request Forgery to Notice Dismissal Travel Monster <= 1.1.2	`CVE-2024-37272`	4.3 Medium	Dhabaleshwar Das	Yes

Showing 1–2 of 2 reports

Latestv1.3.6

Travel Monster

Author

WP Travel Engine

5.0(5)

100/100

Last Updated

2026-04-29 (5mo ago)

Active Installs

4,000+

Downloads

80,193

Requires WP

6.2+

Requires PHP

7.4+

Created

2023-01-18 (4y ago)

Travel Monster is a free travel and tour booking WordPress theme for travel agencies. It is powered by the WP Travel Engine plugin, the most popular travel booking plugin. You can use the Travel Monster theme to create websites such as travel agencies, tour operators, trekking, camping, mountaineering, surfing, city tour, rafting, jungle safari, hiking, tourism, summer holidays, winter holidays, wine tours, cruise websites, beach holidays, etc. You can create itineraries, destinations, activities, trip types. etc. Your website visitors can quickly search for tours and book them. Travel Monster is mobile-friendly, SEO-optimized, translation-ready and RTL-ready. Plus, it is compatible with Elementor and Gutenberg, offering more flexibility to customise your website. Check the demos here: https://wptravelengine.com/travel-monster-demo/. Documentation at https://docs.wptravelengine.com/docs-category/travel-monster/, and get support at https://wptravelengine.com/support/.