Goodlayers
21 CVEs across 11 Goodlayers products. Browse Goodlayers vulnerabilities, severities, and proof-of-concept exploits.
Goodlayers products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69133 | High | 7.5 | 2026-07-02 | Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. |
CVE-2025-59580 | High | 8.8 | 2025-10-22 | Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Escalation.This issue affects Goodlayers Core: from… |
CVE-2025-53343 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-53342 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This iss… |
CVE-2025-48292 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GoodLayers Tourmaster tourmaster allow… |
CVE-2025-39505 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Reflected X… |
CVE-2025-39504 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL I… |
CVE-2025-39503 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a… |
CVE-2025-39502 | High | 7.1 | 2025-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Reflected… |
CVE-2025-39501 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Blind SQL… |
CVE-2025-39500 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from… |
CVE-2025-32923 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Tourmaster tourmaster allows Reflected XSS.Thi… |
CVE-2025-23521 | High | 7.1 | 2025-03-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Blocks goodlayers-blocks allows Ref… |
CVE-2024-13369 | Medium | 6.5 | 2025-02-18 | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up t… |
CVE-2024-12400 | High | 7.1 | 2025-01-30 | The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. |
CVE-2024-12163 | Medium | 6.5 | 2025-01-30 | The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads. |
CVE-2024-11356 | Medium | 6.1 | 2025-01-06 | The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated u… |
CVE-2024-11357 | Medium | 5.9 | 2025-01-02 | The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and abo… |
CVE-2024-11846 | Medium | 6.1 | 2025-01-01 | The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against hi… |
CVE-2024-11200 | Medium | 6.1 | 2024-12-03 | The Goodlayers Core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘font-family’ parameter in all versions up to, and including… |
CVE-2020-27481 | Critical | 9.8 | 2020-11-12 | An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows a… |