Vulnerabilities

TI-2025-01526 CVE-2025-1771 · GHSA-j4hh-pj45-3xqg

Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post

MEDIUM 50

The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00671 Published 2025-03-15 No fix listed CWE-98

TI-2025-01527 CVE-2025-1773 · GHSA-2443-pfqf-c4ch

Traveler <= 3.1.8 - Reflected Cross-Site Scripting

LOW 27

The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00256 Published 2025-03-15 No fix listed CWE-79

Vulnerabilities

Filters

Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post

Traveler <= 3.1.8 - Reflected Cross-Site Scripting