The WP Travel Engine – Tour Booking Plugin suffers from a stored cross‑site scripting vulnerability. Attackers who can authenticate with contributor level or higher can supply arbitrary script code via attributes of the plugin’s wte_trip_tax shortcode. When a user loads a page containing the injected shortcode, the attacker’s script executes in the victim’s browser, allowing theft of session data, cookie hijacking, or other client‑side attacks.

WordPress sites running WP Travel Engine versions up to and including 6.7.5 are affected. Site owners using earlier plugin versions should verify they are using version 6.7.6 or later to eliminate the flaw.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. External Public Supply Score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Because the attacker requires authenticated contributor access, exploitation likelihood depends on the availability of such accounts and whether the site exposes the affected shortcode in editable content. Once accessed, the stored nature of the payload means the attack can affect any user who views the affected page.