WP Travel – Ultimate Travel Booking System, Tour Management Engine

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. A declining trend compresses what a buyer would pay.

Recent releases and news for this plugin

1. — Version 11.8.1 Release Date: 10th July 2026 Fixes * Security: Multiple security hardening improvements. * Security: Improved payment request validation and authorization checks. * Security: Enhanced booking access controls. 11.8.1
2. — Version 11.8.0 Release Date: 06th July 2026 Fixes * Fixed a vulnerability that allowed attackers to extract usernames and passwords through SQL injection in the wp_travel_update_trip request. * Fixed an SQL injection vulnerability in t 11.8.0
3. — Version 11.7.2 Release Date: 29th June 2026 Fixes * Added ownership validation to cart update, cart removal, and apply coupon actions. 11.7.2
4. — Version 11.7.1 Release Date: 23th June 2026 Fixes * Added an authentication + ownership check to “wp_travel_cancel_booking_callback()”. * Removed “wp_ajax_nopriv_wp_travel_cancel_booking” registration. 11.7.1
5. — Version 11.7.0 Release Date: 9th June 2026 Fixes: * Fixed an issue where the WP Travel Dashboard page was not automatically set during the initial setup process. * Resolved a plugin activation issue that triggered a database error when 11.7.0
6. — Version 11.6.0 Release Date: 20th May 2026 Fixes: * Updated the Archive Page Search Form so that the Location taxonomy is displayed in a parent–child hierarchical structure within select options. * Audited AJAX requests and added appro 11.6.0

11 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass ↗
   2026-08-04 CVE-2026-13143 Missing Authorization Affects < 11.8.1 Patched in 11.8.1
2. Medium · 4.3 WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
   2026-07-30 CVE-2026-13145 Authorization Bypass Through User-Controlled Key Affects < 11.8.1 Patched in 11.8.1
3. Medium · 5.3 Travel <= 11.7.0 - Missing Authorization ↗
   2026-06-29 CVE-2026-11868 Missing Authorization Affects <= 11.7.0 Patched in 11.7.1
4. Medium · 6.5 WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection ↗
   2026-05-09 CVE-2026-45218 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 11.4.0 Patched in 11.5.0
5. Medium · 5.3 Travel <= 11.1.0 - Missing Authorization ↗
   2026-01-21 CVE-2026-24568 Missing Authorization Affects <= 11.1.0 Patched in 11.1.1
6. Medium · 6.5 WP Travel <= 10.1.3 - Authenticated (Author+) SQL Injection ↗
   2025-01-31 CVE-2025-22691 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 10.1.3 Patched in 10.1.4
7. Medium · 6.5 WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection ↗
   2025-01-08 CVE-2024-12067 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 10.0.0 Patched in 10.0.1
8. Medium · 6.5 WP Travel <= 9.6.0 - Missing Authorization ↗
   2024-12-02 CVE-2024-53813 Missing Authorization Affects <= 9.6.0 Patched in 9.7.0
9. Medium · 4.4 WP Travel <= 9.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-09-23 CVE-2024-44039 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.3.1 Patched in 9.4.0
10. High · 7.5 WP Travel <= 7.7.0 - Missing Authorization via Multiple AJAX Actions ↗
    2023-11-03 CVE-2023-47224 Missing Authorization Affects <= 7.7.0 Patched in 7.8.1
11. Medium · 4.3 WP Travel <= 4.4.6 - Cross-Site Request Forgery Bypass ↗
    2021-03-01 CVE-2021-4389 Cross-Site Request Forgery (CSRF) Affects <= 4.4.6 Patched in 4.4.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 17 languages, 2 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-03-09 5K+ → 4K+ down after 2 days in tier
2. 2026-03-07 4K+ → 5K+ up after 11 days in tier
3. 2026-02-24 5K+ → 4K+ down after 486 days in tier
4. 2024-10-26 6K+ → 5K+ down after 1 days in tier
5. 2024-10-25 5K+ → 6K+ up after 1 days in tier
6. 2024-10-24 6K+ → 5K+ down after 1 days in tier
7. 2024-10-23 5K+ → 6K+ up after 6 days in tier
8. 2024-10-17 6K+ → 5K+ down after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WP Travel Engine – Tour Booking Plugin – Tour Operator Software 20K+ installs · 4.9★ · 5 shared tags A
• WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor 10K+ installs · 3.6★ · 5 shared tags B
• Travel Agency Companion – Create Tour & Travel Website Using WP Travel Engine 3K+ installs · 3.7★ · 5 shared tags D
• Travel Booking Toolkit 3K+ installs · 3.6★ · 5 shared tags B
• Yatra – Travel Booking & Tour Operator Software 600+ installs · 4.4★ · 5 shared tags A
• Travelly – Tour & Travel Booking Manager for WooCommerce 1K+ installs · 4.6★ · 4 shared tags A

Embed this report card

Drop a live Pulse card for WP Travel – Ultimate Travel Booking System, Tour Management Engine into a readme, a review or a deck. It updates itself.

WP Travel – Ultimate Travel Booking System, Tour Management Engine: 4K+ active installs, 4.7★ (164 reviews). Plugin Pulse (WP Mayor), as of 2026-08-30. https://plugins.wpmayor.com/plugin/wp-travel