Goodlayers vulnerabilities

Products

• Tourmaster 8
• Hostel 3
• Hotel 3
• Tour Master 3
• Core 2
• Core 2
• Modernize 2

Newest

• goodlayers tourmaster WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability CVE-2026-28166 7.1 HighAugust 24, 2026
• goodlayers tourmaster Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export CVE-2026-14240 5.3 MediumAugust 6, 2026
• goodlayers tourmaster Tourmaster < 5.4.8 - Stored XSS via CSRF CVE-2026-14239 7.1 HighJuly 30, 2026
• goodlayers tourmaster WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability CVE-2025-69133 7.5 HighJuly 2, 2026
• goodlayers core WordPress Goodlayers Core plugin < 2.1.7 - Privilege Escalation vulnerability CVE-2025-59580 8.8 HighOctober 22, 2025
• goodlayers modernize WordPress Modernize Theme <= 3.4.0 - Cross Site Scripting (XSS) Vulnerability CVE-2025-53342 6.5 MediumAugust 14, 2025
• goodlayers modernize WordPress Modernize Theme <= 3.4.0 - Broken Access Control Vulnerability CVE-2025-53343 4.3 MediumAugust 14, 2025
• goodlayers hostel WordPress Goodlayers Hostel plugin <= 3.1.4 - SQL Injection vulnerability CVE-2025-39501 9.3 CriticalMay 23, 2025
• goodlayers hostel WordPress Goodlayers Hostel Plugin <= 3.1.2 - PHP Object Injection vulnerability CVE-2025-39500 9.8 CriticalMay 23, 2025
• goodlayers hotel WordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerability CVE-2025-39503 9.8 CriticalMay 23, 2025
• goodlayers hostel WordPress Goodlayers Hostel Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-39502 7.1 HighMay 23, 2025
• goodlayers hotel WordPress Goodlayers Hotel plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-39505 7.1 HighMay 23, 2025
• goodlayers hotel WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerability CVE-2025-39504 9.3 CriticalMay 23, 2025
• goodlayers tourmaster WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability CVE-2025-48292 8.1 HighMay 23, 2025
• goodlayers tourmaster WordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting (XSS) vulnerability CVE-2025-32923 7.1 HighApril 15, 2025
• goodlayers blocks, notfound goodlayers blocks +1 more WordPress Goodlayers Blocks plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-23521 7.1 HighMarch 3, 2025
• goodlayers tour master - tour booking, travel, hotel, tour master +1 more Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter CVE-2024-13369 6.5 MediumFebruary 18, 2025
• goodlayers tourmaster, tour master +1 more Tourmaster < 5.3.5 - Reflected XSS CVE-2024-12400 7.1 HighJanuary 30, 2025
• goodlayers core, unknown goodlayers-core +1 more GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload CVE-2024-12163 6.5 MediumJanuary 30, 2025
• goodlayers tourmaster, tour master +1 more Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking CVE-2024-11356 6.1 MediumJanuary 6, 2025
• goodlayers core, unknown goodlayers-core +1 more Goodlayers Core < 2.0.10 - Contributor+ Stored XSS CVE-2024-11357 5.9 MediumJanuary 2, 2025
• goodlayers travel tour, unknown traveltour +1 more Travel Tour < 5.2.4 - Reflected XSS CVE-2024-11846 6.1 MediumJanuary 1, 2025
• goodlayers core Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family' CVE-2024-11200 6.1 MediumDecember 3, 2024
• goodlayers good learning management system An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to... CVE-2020-27481 9.8 CriticalNovember 12, 2020