Yatra – Travel & Tour Booking Plugin Security & Risk Analysis

wordpress.org/plugins/yatra

Transform your site into a powerful travel booking platform with Yatra - trusted by 1,000+ travel businesses worldwide.

800 active installs v2.3.3 PHP 7.0+ WP 5.6+ Updated Dec 21, 2025
tour-bookingtour-operatortravel-agencytravel-bookingtravel-website
100
A · Safe
CVEs total1
Unpatched0
Last CVEApr 19, 2023
Safety Verdict

Is Yatra – Travel & Tour Booking Plugin Safe to Use in 2026?

Generally Safe

Score 100/100

Yatra – Travel & Tour Booking Plugin has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Apr 19, 2023Updated 3mo ago
Risk Assessment

The 'yatra' plugin v2.3.3 exhibits a mixed security posture. On the positive side, it has a decent number of entry points (6 AJAX handlers) but crucially, all are protected by authentication checks, which is a strong security practice. The presence of numerous nonce and capability checks further reinforces this good practice. However, the static analysis reveals some concerning code signals, notably the use of the 'unserialize' function, which can be a significant vulnerability vector if not handled with extreme care, especially when dealing with user-supplied input. While taint analysis shows no critical or high severity unsanitized flows, the presence of 5 flows with unsanitized paths, even if classified lower, warrants attention.

The plugin's vulnerability history includes one medium severity CVE related to Cross-site Scripting, which was patched. The fact that there are no currently unpatched vulnerabilities is positive. However, the recurring nature of XSS vulnerabilities in its past suggests that developers need to be particularly vigilant about output escaping and input validation to prevent similar issues from arising in the future. The percentage of properly escaped outputs (78%) is good but not perfect, leaving room for potential XSS if the unescaped outputs are reachable by untrusted input.

In conclusion, 'yatra' v2.3.3 demonstrates good practices in access control and authentication for its entry points. The absence of unpatched CVEs is also reassuring. Nevertheless, the reliance on 'unserialize' without explicit sanitization context in the provided data and the existence of unsanitized paths in taint analysis represent potential risks that require careful review and mitigation. The past XSS vulnerability serves as a reminder of the ongoing need for robust input validation and output escaping.

Key Concerns

  • Use of 'unserialize' function detected
  • Flows with unsanitized paths detected (5)
  • Medium severity CVE in history (patched)
  • Output escaping not fully comprehensive (78%)
Vulnerabilities
1

Yatra – Travel & Tour Booking Plugin Security Vulnerabilities

CVEs by Year

1 CVE in 2023
2023
Patched Has unpatched

Severity Breakdown

Medium
1

1 total CVE

CVE-2022-47436medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Yatra <= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting

Apr 19, 2023 Patched in 2.1.15 (279d)
Code Analysis
Analyzed Mar 16, 2026

Yatra – Travel & Tour Booking Plugin Code Analysis

Dangerous Functions
2
Raw SQL Queries
10
29 prepared
Unescaped Output
613
2112 escaped
Nonce Checks
28
Capability Checks
17
File Operations
30
External Requests
7
Bundled Libraries
1

Dangerous Functions Found

unserialize$instance = @unserialize($value);core\Libraries\Carbon.php:3362
unserialize$value = @unserialize($this->session[$key]);core\Session.php:169

Bundled Libraries

Select2

SQL Query Safety

74% prepared39 total queries

Output Escaping

78% escaped2725 total outputs
Data Flows
5 unsanitized

Data Flow Analysis

17 flows5 with unsanitized paths
import_content (includes\class-yatra-ajax.php:395)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Yatra – Travel & Tour Booking Plugin Attack Surface

Entry Points6
Unprotected0

AJAX Handlers 6

authwp_ajax_yatra_notice_dismisscore\Admin\Notices.php:61
authwp_ajax_yatra_premium_redirectcore\Premium.php:133
authwp_ajax_yatra_enable_feature_and_deactivatecore\ProCompatibility.php:75
authwp_ajax_yatra_go_to_featurescore\ProCompatibility.php:76
authwp_ajax_yatra_activate_procore\ProCompatibility.php:77
authwp_ajax_yatra_add_attribute_metaincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:13
WordPress Hooks 220
actionadmin_noticescore\Admin\Notices.php:60
actioninitcore\Admin\Tracking.php:66
actionyatra_admin_settings_sanitize_option_yatra_allow_trackingcore\Admin\Tracking.php:67
actionadmin_initcore\Admin\Tracking.php:68
actionadmin_noticescore\Admin\Tracking.php:69
actionyatra_weekly_scheduled_eventscore\Admin\Tracking.php:408
actionrest_api_initcore\API\RestBase.php:17
actiondo_meta_boxescore\Compatibility\Astra.php:17
filtercron_schedulescore\Cron.php:17
actionwpcore\Cron.php:18
actionyatra_after_booking_status_changecore\Hooks\BookingHooks.php:16
actiontransition_post_statuscore\Hooks\BookingHooks.php:18
actionbefore_delete_postcore\Hooks\BookingHooks.php:20
actioninitcore\Hooks\EmailHooks.php:15
actionadmin_noticescore\Hooks\NoticeHooks.php:13
filteryatra_after_enquiry_form_fieldscore\Hooks\ReCaptchaHooks.php:11
filteryatra_enquiry_response_before_savedcore\Hooks\ReCaptchaHooks.php:12
filteryatra_checkout_after_form_fieldscore\Hooks\ReCaptchaHooks.php:15
filteryatra_before_booking_processcore\Hooks\ReCaptchaHooks.php:16
actionthe_postcore\Hooks\TourHooks.php:11
actionyatra_after_tour_updatecore\Hooks\TourHooks.php:13
filterpost_updated_messagescore\Hooks\TourHooks.php:15
actionplugins_loadedcore\Libraries\wp-session.php:84
actionshutdowncore\Libraries\wp-session.php:119
actionwp_session_garbage_collectioncore\Libraries\wp-session.php:168
actionwpcore\Libraries\wp-session.php:178
actionadmin_menucore\Premium.php:130
actionadd_meta_boxescore\Premium.php:131
actionadmin_enqueue_scriptscore\Premium.php:132
filteryatra_settings_tabs_arraycore\Premium.php:134
actionadmin_initcore\ProCompatibility.php:73
actionadmin_noticescore\ProCompatibility.php:74
actionadmin_enqueue_scriptscore\ProCompatibility.php:78
actionadmin_noticescore\ProCompatibility.php:129
actioninitcore\Session.php:61
filterwp_session_expiration_variantcore\Session.php:81
filterwp_session_expirationcore\Session.php:82
filteryatra_payment_gatewaysincludes\abstracts\abstract-yatra-payment-gateways.php:29
filteryatra_get_sections_payment-gatewaysincludes\abstracts\abstract-yatra-payment-gateways.php:30
filteryatra_get_settings_payment-gatewaysincludes\abstracts\abstract-yatra-payment-gateways.php:31
actionadmin_bar_menuincludes\admin\admin-bar.php:78
actionwp_print_stylesincludes\admin\admin-bar.php:139
actionadmin_print_stylesincludes\admin\admin-bar.php:140
actionyatra_admin_addon_page_outputincludes\admin\class-yatra-admin-addons.php:7
actionadmin_enqueue_scriptsincludes\admin\class-yatra-admin-addons.php:9
actionadmin_enqueue_scriptsincludes\admin\class-yatra-admin-assets.php:8
actionadmin_footerincludes\admin\class-yatra-admin-assets.php:10
filteryatra_admin_main_submenuincludes\admin\class-yatra-admin-export-import.php:8
actionadmin_enqueue_scriptsincludes\admin\class-yatra-admin-export-import.php:9
actionadmin_initincludes\admin\class-yatra-admin-form-handler.php:7
actioncurrent_screenincludes\admin\class-yatra-admin-permalinks.php:36
actioncurrent_screenincludes\admin\class-yatra-admin-post-types.php:34
actioncheck_ajax_refererincludes\admin\class-yatra-admin-post-types.php:35
filterpost_updated_messagesincludes\admin\class-yatra-admin-post-types.php:38
filterbulk_post_updated_messagesincludes\admin\class-yatra-admin-post-types.php:39
actionadmin_print_scriptsincludes\admin\class-yatra-admin-post-types.php:41
filterdisplay_post_statesincludes\admin\class-yatra-admin-post-types.php:43
actionadmin_initincludes\admin\class-yatra-admin-review.php:13
filteradmin_footer_textincludes\admin\class-yatra-admin-review.php:16
filterupdate_footerincludes\admin\class-yatra-admin-review.php:18
filteryatra_settings_tabs_arrayincludes\admin\class-yatra-admin-settings-base.php:56
filteryatra_admin_main_submenuincludes\admin\class-yatra-admin-tour-enquiries.php:8
filterset_screen_option_yatra_enquiries_page_sizeincludes\admin\class-yatra-admin-tour-enquiries.php:10
actioninitincludes\admin\class-yatra-admin.php:114
actionadmin_initincludes\admin\class-yatra-admin.php:115
actionadmin_menuincludes\admin\class-yatra-admin.php:116
actionadmin_menuincludes\admin\class-yatra-admin.php:117
actionadmin_noticesincludes\admin\class-yatra-admin.php:118
actionadmin_noticesincludes\admin\class-yatra-admin.php:119
filterparent_fileincludes\admin\class-yatra-admin.php:122
filteryatra_admin_main_submenuincludes\admin\class-yatra-admin.php:124
actionwp_dashboard_setupincludes\admin\dashboard\class-mantrabrain-admin-dashboard.php:125
actionmanage_posts_extra_tablenavincludes\admin\list-tables\abstract-class-yatra-admin-list-table.php:41
filterview_mode_post_typesincludes\admin\list-tables\abstract-class-yatra-admin-list-table.php:42
actionrestrict_manage_postsincludes\admin\list-tables\abstract-class-yatra-admin-list-table.php:43
filterrequestincludes\admin\list-tables\abstract-class-yatra-admin-list-table.php:44
filterpost_row_actionsincludes\admin\list-tables\abstract-class-yatra-admin-list-table.php:45
filterdefault_hidden_columnsincludes\admin\list-tables\abstract-class-yatra-admin-list-table.php:46
filterlist_table_primary_columnincludes\admin\list-tables\abstract-class-yatra-admin-list-table.php:47
actionadmin_menuincludes\admin\setup\class-yatra-setup-wizard.php:28
actionadmin_initincludes\admin\setup\class-yatra-setup-wizard.php:29
actionwp_enqueue_scriptsincludes\class-yatra-assets.php:8
actionwp_enqueue_scriptsincludes\class-yatra-assets.php:10
actioninitincludes\class-yatra-cart.php:12
actioninitincludes\class-yatra-cart.php:13
filteryatra_booking_final_priceincludes\class-yatra-cart.php:14
filteryatra_after_update_tour_cartincludes\class-yatra-cart.php:15
actionafter_setup_themeincludes\class-yatra-compatibility.php:94
actionyatra_email_send_beforeincludes\class-yatra-email.php:32
actionyatra_email_send_afterincludes\class-yatra-email.php:33
actionyatra_after_tour_booking_completedincludes\class-yatra-email.php:40
actionyatra_after_booking_status_changeincludes\class-yatra-email.php:43
actionyatra_enquiry_response_after_savedincludes\class-yatra-email.php:46
filterwp_mail_fromincludes\class-yatra-email.php:198
filterwp_mail_from_nameincludes\class-yatra-email.php:199
actiontemplate_redirectincludes\class-yatra-form-handler.php:21
actiontemplate_redirectincludes\class-yatra-form-handler.php:22
actiontemplate_redirectincludes\class-yatra-form-handler.php:23
actiontemplate_redirectincludes\class-yatra-form-handler.php:24
actiontemplate_redirectincludes\class-yatra-form-handler.php:25
actionwp_headincludes\class-yatra-frontend-tour-tabs.php:10
actioninitincludes\class-yatra-install.php:258
filtertemplate_includeincludes\class-yatra-page-templater.php:27
actioninitincludes\class-yatra-post-types.php:16
actioninitincludes\class-yatra-post-types.php:17
actioninitincludes\class-yatra-post-types.php:18
actionyatra_after_register_post_typeincludes\class-yatra-post-types.php:19
actionyatra_flush_rewrite_rulesincludes\class-yatra-post-types.php:20
actionwidgets_initincludes\class-yatra-widgets.php:9
actioninitincludes\class-yatra.php:213
actioninitincludes\class-yatra.php:214
actionyatra_availability_page_outputincludes\classes\class-yatra-core-tour-availability.php:8
actionadmin_enqueue_scriptsincludes\classes\class-yatra-core-tour-availability.php:10
actionyatra_availability_calendar_tour_listincludes\classes\class-yatra-core-tour-availability.php:12
actionyatra_availability_calendar_tour_list_footerincludes\classes\class-yatra-core-tour-availability.php:14
filteryatra_page_wrapper_classincludes\compatibility\themes\astra\class-yatra-compatibility-themes-astra.php:7
actionkadence_before_contentincludes\compatibility\themes\kadence\class-yatra-compatibility-themes-kadence.php:8
actionkadence_after_contentincludes\compatibility\themes\kadence\class-yatra-compatibility-themes-kadence.php:9
filteryatra_page_wrapper_classincludes\compatibility\themes\kadence\class-yatra-compatibility-themes-kadence.php:10
filteryatra_page_wrapper_classincludes\compatibility\themes\magazinenp\class-yatra-compatibility-themes-magazinenp.php:9
filteryatra_page_wrapper_classincludes\compatibility\themes\oceanwp\class-yatra-compatibility-themes-oceanwp.php:8
filteryatra_page_wrapper_classincludes\compatibility\themes\zakra\class-yatra-compatibility-themes-zakra.php:7
filterpost_row_actionsincludes\custom-post-type\class-yatra-custom-post-type-booking.php:124
filterpost_row_actionsincludes\custom-post-type\class-yatra-custom-post-type-coupons.php:60
actionwp_headincludes\hooks\yatra-design-hooks.php:7
filtermanage_edit-tour_columnsincludes\hooks\yatra-list-table-hooks.php:7
actionmanage_tour_posts_custom_columnincludes\hooks\yatra-list-table-hooks.php:8
filteryatra_register_log_handlersincludes\hooks\yatra-log-handler-hooks.php:8
actionsingle_tour_infoincludes\hooks\yatra-template-hooks.php:8
actionyatra_single_tour_booking_formincludes\hooks\yatra-template-hooks.php:9
actionyatra_tour_booking_pricing_contentincludes\hooks\yatra-template-hooks.php:10
actionyatra_single_tour_enquiry_formincludes\hooks\yatra-template-hooks.php:11
filterexcerpt_moreincludes\hooks\yatra-template-hooks.php:12
filteryatra_page_wrapper_classincludes\hooks\yatra-template-hooks.php:13
filteryatra_tour_classincludes\hooks\yatra-template-hooks.php:14
actionyatra_before_main_content_loopincludes\hooks\yatra-template-hooks.php:15
actionyatra_after_main_content_loopincludes\hooks\yatra-template-hooks.php:16
actionyatra_after_main_content_loopincludes\hooks\yatra-template-hooks.php:18
actionplugins_loadedincludes\log-handlers\class-yatra-log-handler-file.php:50
actionadd_meta_boxesincludes\meta-boxes\class-yatra-metabox-booking-cpt.php:10
actionsave_postincludes\meta-boxes\class-yatra-metabox-booking-cpt.php:12
actiondo_meta_boxesincludes\meta-boxes\class-yatra-metabox-booking-cpt.php:14
actionedit_form_after_editorincludes\meta-boxes\class-yatra-metabox-booking-cpt.php:109
actionsave_postincludes\meta-boxes\class-yatra-metabox-booking-cpt.php:318
actionadd_meta_boxesincludes\meta-boxes\class-yatra-metabox-coupons-cpt.php:9
actionsave_postincludes\meta-boxes\class-yatra-metabox-coupons-cpt.php:11
actionadmin_enqueue_scriptsincludes\meta-boxes\class-yatra-metabox-coupons-cpt.php:13
filtermanage_edit-yatra-coupons_columnsincludes\meta-boxes\class-yatra-metabox-coupons-cpt.php:15
actionmanage_yatra-coupons_posts_custom_columnincludes\meta-boxes\class-yatra-metabox-coupons-cpt.php:16
actionadd_meta_boxesincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:10
actionsave_postincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:12
actionyatra_tour_meta_body_contentincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:14
actionyatra_tour_meta_tab_content_generalincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:15
actionyatra_tour_meta_tab_content_durationincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:16
actionyatra_tour_meta_tab_content_pricingincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:17
actionyatra_tour_meta_tab_content_attributesincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:18
actionyatra_tour_meta_tab_content_tour_tabsincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:19
filteradmin_post_thumbnail_htmlincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:24
actionedit_form_after_editorincludes\meta-boxes\class-yatra-metabox-tour-cpt.php:44
actioninitincludes\modules\blocks\blocks\class-yatra-block-activity.php:7
actioninitincludes\modules\blocks\blocks\class-yatra-block-destination.php:7
actioninitincludes\modules\blocks\blocks\class-yatra-block-tour.php:7
filterblock_categories_allincludes\modules\blocks\class-yatra-blocks.php:9
actionadmin_enqueue_scriptsincludes\modules\dashboard\class-yatra-module-dashboard.php:7
actionadmin_menuincludes\modules\dashboard\class-yatra-module-dashboard.php:8
actionyatra_before_main_content_loopincludes\modules\filters\class-yatra-module-filters.php:22
actionyatra_after_main_content_loopincludes\modules\filters\class-yatra-module-filters.php:23
filteryatra_script_localize_paramsincludes\modules\filters\class-yatra-module-filters.php:24
actionyatra_after_tour_updateincludes\modules\filters\class-yatra-module-filters.php:28
actionpre_get_postsincludes\modules\filters\includes\class-yatra-filter-query.php:7
actionyatra_before_main_content_loopincludes\modules\filters\includes\class-yatra-module-filter-sidebar.php:24
actionyatra_before_main_content_area_innerincludes\modules\filters\includes\class-yatra-module-filter-top.php:20
actionadmin_enqueue_scriptsincludes\modules\status\class-yatra-module-status.php:7
filteryatra_admin_main_submenuincludes\modules\status\class-yatra-module-status.php:8
actionadmin_initincludes\modules\status\class-yatra-module-status.php:9
actionyatra_status_system_statusincludes\modules\status\class-yatra-module-status.php:10
actionyatra_status_logsincludes\modules\status\class-yatra-module-status.php:11
actionyatra_payment_checkout_payment_gateway_booking_onlyincludes\payment-gateways\booking-only\class-yatra-payment-gateway-booking-only.php:22
actioninitincludes\payment-gateways\paypal\class-yatra-payment-gateway-paypal.php:23
actionyatra_payment_checkout_payment_gateway_paypalincludes\payment-gateways\paypal\class-yatra-payment-gateway-paypal.php:24
actionyatra_verify_paypal_ipnincludes\payment-gateways\paypal\class-yatra-payment-gateway-paypal.php:25
actionactivity_add_form_fieldsincludes\taxonomy\class-yatra-taxonomy-activity.php:8
actionactivity_edit_form_fieldsincludes\taxonomy\class-yatra-taxonomy-activity.php:9
actionedited_activityincludes\taxonomy\class-yatra-taxonomy-activity.php:10
actioncreated_activityincludes\taxonomy\class-yatra-taxonomy-activity.php:11
actionattributes_add_form_fieldsincludes\taxonomy\class-yatra-taxonomy-attributes.php:10
actionattributes_edit_form_fieldsincludes\taxonomy\class-yatra-taxonomy-attributes.php:11
actionedited_attributesincludes\taxonomy\class-yatra-taxonomy-attributes.php:12
actioncreated_attributesincludes\taxonomy\class-yatra-taxonomy-attributes.php:13
actionmanage_attributes_custom_columnincludes\taxonomy\class-yatra-taxonomy-attributes.php:14
actionmanage_edit-attributes_columnsincludes\taxonomy\class-yatra-taxonomy-attributes.php:15
actiondestination_add_form_fieldsincludes\taxonomy\class-yatra-taxonomy-destination.php:9
actiondestination_edit_form_fieldsincludes\taxonomy\class-yatra-taxonomy-destination.php:10
actionedited_destinationincludes\taxonomy\class-yatra-taxonomy-destination.php:11
actioncreated_destinationincludes\taxonomy\class-yatra-taxonomy-destination.php:12
actionyatra_checkout_before_formincludes\yatra-hooks.php:38
actionyatra_checkout_form_fieldsincludes\yatra-hooks.php:52
actionyatra_main_contentincludes\yatra-hooks.php:89
actionyatra_before_main_contentincludes\yatra-hooks.php:108
actionyatra_after_main_contentincludes\yatra-hooks.php:118
actionyatra_before_page_contentincludes\yatra-hooks.php:172
actionyatra_after_page_contentincludes\yatra-hooks.php:183
actionyatra_account_navigationincludes\yatra-template-hooks.php:3
actionyatra_account_contentincludes\yatra-template-hooks.php:4
actionyatra_account_dashboard_endpointincludes\yatra-template-hooks.php:5
actionyatra_account_bookings_endpointincludes\yatra-template-hooks.php:6
actionyatra_account_payment_endpointincludes\yatra-template-hooks.php:7
actionyatra_account_bookings_item_endpointincludes\yatra-template-hooks.php:8
actionyatra_account_bookings_item_endpointincludes\yatra-template-hooks.php:9
actionyatra_account_edit-profile_endpointincludes\yatra-template-hooks.php:10
actionyatra_account_change-password_endpointincludes\yatra-template-hooks.php:11
actionyatra_my_account_edit_profile_form_fieldsincludes\yatra-template-hooks.php:12
actionyatra_my_account_change_password_form_fieldsincludes\yatra-template-hooks.php:13
actionyatra_before_account_contentincludes\yatra-template-hooks.php:14
actionyatra_before_customer_login_formincludes\yatra-template-hooks.php:15
actionyatra_before_customer_registration_formincludes\yatra-template-hooks.php:16
actionyatra_registration_form_startincludes\yatra-template-hooks.php:17
actionyatra_checkout_before_formincludes\yatra-template-hooks.php:18
actionyatra_checkout_form_fieldsincludes\yatra-template-hooks.php:19
actionyatra_enquiry_form_fieldsincludes\yatra-template-hooks.php:23

Scheduled Events 3

yatra_weekly_scheduled_events
yatra_daily_scheduled_events
wp_session_garbage_collection
Maintenance & Trust

Yatra – Travel & Tour Booking Plugin Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedDec 21, 2025
PHP min version7.0
Downloads54K

Community Trust

Rating92/100
Number of ratings20
Active installs800
Developer Profile

Yatra – Travel & Tour Booking Plugin Developer Profile

MantraBrain

11 plugins · 9K total installs

87
trust score
Avg Security Score
98/100
Avg Patch Time
88 days
View full developer profile
Detection Fingerprints

How We Detect Yatra – Travel & Tour Booking Plugin

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/yatra/core/Admin/assets/js/notices.js
Script Paths
/wp-content/plugins/yatra/core/Admin/assets/js/notices.js
Version Parameters
yatra-admin-notices?ver=

HTML / DOM Fingerprints

CSS Classes
yatra-notice
Data Attributes
data-yatra-admin-notices
JS Globals
yatra_admin_notices
FAQ

Frequently Asked Questions about Yatra – Travel & Tour Booking Plugin