Read the docs

shinetheme

Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

shinetheme records in CISA KEV

No shinetheme vulnerabilities are listed in CISA KEV.

Records

22 records

TI-2026-20562 CVE-2026-25449 · GHSA-8p35-x5r4-v8h6

WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00341 Published 2026-03-18 No fix listed CWE-502
TI-2025-19769 CVE-2025-26898 · GHSA-33fg-76g4-jv5r

WordPress Traveler theme < 3.2.1 - SQL Injection vulnerability

Priority MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.0035 Published 2025-03-27 No fix listed CWE-89
TI-2026-69914 CVE-2026-93947 · GHSA-3rhj-j5m7-5p66

Blind SQL injection in Shinetheme Traveler WordPress theme

Priority MEDIUM 45

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00229 Published 2026-10-09 No fix listed CWE-89
TI-2025-32764 CVE-2025-52714 · GHSA-4xjq-p3mf-wp23

WordPress Traveler theme < 3.2.2 - SQL Injection Vulnerability

Priority MEDIUM 42

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00435 Published 2025-07-16 No fix listed CWE-89
TI-2025-36654 CVE-2025-59011 · GHSA-p53x-h8g9-fv36

WordPress Traveler Theme < 3.2.3 - Arbitrary Content Deletion Vulnerability

Priority LOW 39

Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00382 Published 2025-09-26 No fix listed CWE-862
TI-2024-11051 CVE-2024-11912 · GHSA-4frf-ph8g-p825

Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id

Priority LOW 39

The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user sup…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00468 Published 2024-12-18 No fix listed CWE-89
TI-2025-39806 CVE-2025-64373 · GHSA-vq4g-pvpg-cp9j

WordPress Traveler theme < 3.2.6 - Local File Inclusion vulnerability

Priority LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00404 Published 2025-12-18 No fix listed CWE-98
TI-2026-19640 CVE-2026-24367 · GHSA-jqg4-9wc7-2cqr

WordPress Traveler theme < 3.2.8 - SQL Injection vulnerability

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00243 Published 2026-01-22 No fix listed CWE-89
TI-2025-39804 CVE-2025-64371 · GHSA-8m8r-54m9-6p7v

WordPress Traveler theme < 3.2.6 - SQL Injection vulnerability

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00251 Published 2025-12-18 No fix listed CWE-89
TI-2025-41526 CVE-2025-67917 · GHSA-458q-g468-2frr

WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability

Priority LOW 35

Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00287 Published 2026-01-08 No fix listed CWE-862
TI-2025-39805 CVE-2025-64372 · GHSA-44r9-whmc-g7gq

WordPress Traveler theme < 3.2.6 - Cross Site Scripting (XSS) vulnerability

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00178 Published 2025-12-18 No fix listed CWE-79
TI-2025-39176 CVE-2025-63028 · GHSA-62pw-38x5-7w37

WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability

Priority LOW 30

Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00247 Published 2025-12-09 No fix listed CWE-862
TI-2024-11065 CVE-2024-11926 · GHSA-879p-w4cg-gqp5

Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions

Priority LOW 29

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental', 'st_delete_order_item', '_st_partner_ap…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0031 Published 2024-12-18 No fix listed CWE-862
TI-2025-16583 CVE-2025-22701 · GHSA-v57f-fqvf-vc6v

WordPress Traveler Layout Essential For Elementor plugin < 1.4 - Server Side Request Forgery (SSRF) vulnerability

Priority LOW 24

Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through…

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00304 Published 2025-02-03 No fix listed CWE-918
TI-2025-31348 CVE-2025-49300 · GHSA-x9qg-qg5q-w7wm

WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability

Priority LOW 13

Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00273 Published 2025-12-16 No fix listed CWE-201
Open these records in search →