| #1 | Agoda Affiliate Partners Text Link Generator | 42 | 4 | 40 | 500 | | | Interpolated SQL is not prepared |
| #2 | Car Route Planner Plugin | 38 | 135 | 17 | 400 | | | Output is not escaped |
| #3 | Tourfic Toolkit | 37 | 67 | 165 | 1k+ | | | Post Not In exclude |
| #4 | Travel Agency Companion – Create Tour & Travel Website Using WP Travel Engine | 34 | 128 | 211 | 4k+ | | | Non-prefixed global variable |
| #5 | Nomad World Map | 33 | 424 | 191 | 700 | | | Text Domain Mismatch |
| #6 | Travel Booking Toolkit | 30 | 245 | 324 | 3k+ | | | Non-prefixed global variable |
| #7 | Hotel Booking | 26 | 690 | 940 | 4k+ | | | Unsafe printing function |
| #8 | Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution | 25 | 173 | 726 | 1k+ | | | Non-prefixed global variable |
| #9 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 227 | 1,954 | 4k+ | | | Non-prefixed hook name |
| #10 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,012 | 5,689 | 20k+ | | | Non-prefixed global variable |
| #11 | WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor | 24 | 5,907 | 2,136 | 10k+ | | | Text Domain Mismatch |
| #12 | Yatra – Travel Booking & Tour Operator Software | 23 | 2,226 | 3,997 | 600 | | | Non-prefixed global variable |
