Vulnerabilities

TI-2026-69914 CVE-2026-93947 · GHSA-3rhj-j5m7-5p66

Blind SQL injection in Shinetheme Traveler WordPress theme

MEDIUM 45

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00229 Published 2026-10-09 No fix listed CWE-89

TI-2026-20562 CVE-2026-25449 · GHSA-8p35-x5r4-v8h6

WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00341 Published 2026-03-18 No fix listed CWE-502

TI-2026-19640 CVE-2026-24367 · GHSA-jqg4-9wc7-2cqr

WordPress Traveler theme < 3.2.8 - SQL Injection vulnerability

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00243 Published 2026-01-22 No fix listed CWE-89

TI-2025-41526 CVE-2025-67917 · GHSA-458q-g468-2frr

WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability

LOW 35

Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00287 Published 2026-01-08 No fix listed CWE-862

TI-2025-39806 CVE-2025-64373 · GHSA-vq4g-pvpg-cp9j

WordPress Traveler theme < 3.2.6 - Local File Inclusion vulnerability

LOW 37

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00404 Published 2025-12-18 No fix listed CWE-98

TI-2025-39805 CVE-2025-64372 · GHSA-44r9-whmc-g7gq

WordPress Traveler theme < 3.2.6 - Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00178 Published 2025-12-18 No fix listed CWE-79

TI-2025-39804 CVE-2025-64371 · GHSA-8m8r-54m9-6p7v

WordPress Traveler theme < 3.2.6 - SQL Injection vulnerability

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00251 Published 2025-12-18 No fix listed CWE-89

TI-2025-31348 CVE-2025-49300 · GHSA-x9qg-qg5q-w7wm

WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability

LOW 13

Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00273 Published 2025-12-16 No fix listed CWE-201

TI-2025-39176 CVE-2025-63028 · GHSA-62pw-38x5-7w37

WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00247 Published 2025-12-09 No fix listed CWE-862

TI-2025-36655 CVE-2025-59012 · GHSA-4hr6-6848-gjfw

WordPress Traveler theme < 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00235 Published 2025-09-26 No fix listed CWE-79

TI-2025-36654 CVE-2025-59011 · GHSA-p53x-h8g9-fv36

WordPress Traveler Theme < 3.2.3 - Arbitrary Content Deletion Vulnerability

LOW 39

Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00382 Published 2025-09-26 No fix listed CWE-862

TI-2025-32764 CVE-2025-52714 · GHSA-4xjq-p3mf-wp23

WordPress Traveler theme < 3.2.2 - SQL Injection Vulnerability

MEDIUM 42

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00435 Published 2025-07-16 No fix listed CWE-89

TI-2025-19649 CVE-2025-26733 · GHSA-8w5m-q4c7-vwgq

WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerability

MEDIUM 42

Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00363 Published 2025-03-27 No fix listed CWE-862

TI-2025-19744 CVE-2025-26873 · GHSA-3wrq-rm5m-mgw2

WordPress Traveler theme <= 3.1.8 - PHP Object Injection vulnerability

MEDIUM 41

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00427 Published 2025-03-27 No fix listed CWE-502

TI-2025-19769 CVE-2025-26898 · GHSA-33fg-76g4-jv5r

WordPress Traveler theme < 3.2.1 - SQL Injection vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.0035 Published 2025-03-27 No fix listed CWE-89

TI-2025-19827 CVE-2025-26956 · GHSA-hgg5-pp3m-2v92

WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerability

LOW 33

Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00259 Published 2025-03-27 No fix listed CWE-862

TI-2024-11872 CVE-2024-12811 · GHSA-x49p-h589-rcc4

Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode

MEDIUM 41

The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00761 Published 2025-02-27 No fix listed CWE-98

TI-2025-16582 CVE-2025-22700 · GHSA-gh56-p8p5-mmjw

WordPress Traveler Code plugin < 3.1.3 - Subscriber+ Arbitrary SQL Execution vulnerability

LOW 39

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.3.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00366 Published 2025-02-04 No fix listed CWE-89

TI-2025-16581 CVE-2025-22699 · GHSA-p998-36qv-wx8v

WordPress Traveler Code plugin < 3.1.2 - Unauthenticated Arbitrary SQL Execution vulnerability

MEDIUM 41

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.0038 Published 2025-02-04 No fix listed CWE-89

TI-2025-16583 CVE-2025-22701 · GHSA-v57f-fqvf-vc6v

WordPress Traveler Layout Essential For Elementor plugin < 1.4 - Server Side Request Forgery (SSRF) vulnerability

LOW 24

Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through…

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00304 Published 2025-02-03 No fix listed CWE-918

TI-2024-11051 CVE-2024-11912 · GHSA-4frf-ph8g-p825

Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id

LOW 39

The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user sup…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00468 Published 2024-12-18 No fix listed CWE-89

TI-2024-11065 CVE-2024-11926 · GHSA-879p-w4cg-gqp5

Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions

LOW 29

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental', 'st_delete_order_item', '_st_partner_ap…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0031 Published 2024-12-18 No fix listed CWE-862

Vulnerabilities

Filters