{"id":"CVE-2024-0337","aliases":["EUVD-2024-16133","GHSA-7ph5-37r4-fwh8"],"status":"published","title":"Travelpayouts \u003c= 1.1.15 - Open Redirect","description":"The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00891,"percentile":0.59677,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-601"],"published":"2024-03-20T05:00:02Z","modified":"2026-06-17T06:53:17Z","exploits":[{"source":"nuclei","id":"CVE-2024-0337","title":"Travelpayouts \u003c= 1.1.16 - Open Redirect","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0337.yaml"}],"products":[{"vendor":"travelpayouts","product":"travelpayouts"},{"vendor":"unknown","product":"travelpayouts: all travel brands in one place"}],"references":[{"url":"https://wpscan.com/vulnerability/2f17a274-8676-4f4e-989f-436030527890/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0337"},{"url":"https://wpscan.com/vulnerability/2f17a274-8676-4f4e-989f-436030527890"},{"url":"https://github.com/advisories/GHSA-7ph5-37r4-fwh8"}],"sources":{"cve":[{"id":"CVE-2024-0337","title":"Travelpayouts \u003c= 1.1.15 - Open Redirect","description":"The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.","status":"published","published":"2024-03-20T05:00:02.494Z","modified":"2024-08-01T18:18:19.215Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:22.852179Z"}],"euvd":[{"id":"EUVD-2024-16133","description":"The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.","status":"published","published":"2024-03-20T05:00:02Z","modified":"2024-08-01T18:18:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:41.523881Z"}],"ghsa":[{"id":"GHSA-7ph5-37r4-fwh8","title":"The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable...","description":"The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.","status":"published","published":"2024-03-20T15:32:29Z","modified":"2025-05-05T21:32:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:02:07.964163Z"}],"nvd":[{"id":"CVE-2024-0337","description":"The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.","status":"published","published":"2024-03-20T05:15:45.387Z","modified":"2026-06-17T06:53:17.59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:09:41.654534Z"}]}}