Travel Booking WordPress Theme

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Themes   >   Travel Booking WordPress Theme

Information

Software Type Theme
Software Slug traveler
Software Status Active
Software Author ShineTheme
Software Website themeforest.net
Software Active Installs 19,200
Software Record Last Updated April 24, 2025

Showing 1-20 of 24 Vulnerabilities

Submit a Vulnerability
Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection
8.1
CVE-2026-25449
Mar 17, 2026
Researcher: Phat RiO
Traveler < 3.2.8 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-24367
Jan 22, 2026
Researcher: João Pedro Soares de Alcântara
Traveler <= 3.2.6 - Missing Authorization
5.3
CVE-2025-67917
Jan 5, 2026
Researcher: Rafie Muhammad
Traveler < 3.2.6 - Reflected Cross-Site Scripting
6.1
CVE-2025-64372
Nov 7, 2025
Researcher: João Pedro Soares de Alcântara
Traveler < 3.2.6 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-64371
Nov 7, 2025
Researcher: João Pedro Soares de Alcântara
Traveler <= 3.2.6 - Missing Authorization
5.3
CVE-2025-63028
Nov 7, 2025
Researcher: João Pedro Soares de Alcântara
Traveler < 3.2.6 - Unauthenticated Local File Inclusion
8.1
CVE-2025-64373
Nov 6, 2025
Researcher: João Pedro Soares de Alcântara
Travel Booking WordPress Theme < 3.2.3 - Reflected Cross-Site Scripting
6.1
CVE-2025-59012
Sep 6, 2025
Researcher: Tran Nguyen Bao Khanh
Travel Booking WordPress Theme < 3.2.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
5.3
CVE-2025-59011
Sep 6, 2025
Researcher: Tran Nguyen Bao Khanh
Traveler < 3.2.2 - Unauthenticated SQL Injection
7.5
CVE-2025-52714
Jul 10, 2025
Researcher: Frank
Traveler <= 3.2.0 - Unauthenticated SQL Injection
7.5
CVE-2025-26898
Mar 27, 2025
Researcher: Rafie Muhammad
Traveler < 3.2.1 - Unauthenticated PHP Object Injection
9.8
CVE-2025-26873
Mar 27, 2025
Researcher: Rafie Muhammad
Traveler <= 3.2.0 - Missing Authorization
5.3
CVE-2025-26733
Mar 27, 2025
Researcher: Rafie Muhammad
Traveler <= 3.2.0 - Missing Authorization
4.3
CVE-2025-26956
Mar 27, 2025
Researcher: Rafie Muhammad
Traveler <= 3.1.8 - Reflected Cross-Site Scripting
6.1
CVE-2025-1773
Mar 14, 2025
Researcher: István Márton
Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post
9.8
CVE-2025-1771
Mar 14, 2025
Researcher: István Márton
Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode
8.8
CVE-2024-12811
Feb 27, 2025
Researcher: István Márton
Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions
6.5
CVE-2024-11926
Dec 17, 2024
Researcher: Lucio Sá
Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id
7.5
CVE-2024-11912
Dec 17, 2024
Researcher: Lucio Sá
Traveler – Travel Booking WordPress Theme < 2.8.4 - Cross-Site Scripting
6.1
CVE ID Unknown
Jun 23, 2020
Researcher: R3N0
Title Status CVE ID CVSS Researchers Date
Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection Patched CVE-2026-25449 8.1 Phat RiO March 17, 2026
Traveler < 3.2.8 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-24367 6.5 João Pedro Soares de Alcântara January 22, 2026
Traveler <= 3.2.6 - Missing Authorization Patched CVE-2025-67917 5.3 Rafie Muhammad January 5, 2026
Traveler < 3.2.6 - Reflected Cross-Site Scripting Patched CVE-2025-64372 6.1 João Pedro Soares de Alcântara November 7, 2025
Traveler < 3.2.6 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-64371 6.5 João Pedro Soares de Alcântara November 7, 2025
Traveler <= 3.2.6 - Missing Authorization Unpatched CVE-2025-63028 5.3 João Pedro Soares de Alcântara November 7, 2025
Traveler < 3.2.6 - Unauthenticated Local File Inclusion Patched CVE-2025-64373 8.1 João Pedro Soares de Alcântara November 6, 2025
Travel Booking WordPress Theme < 3.2.3 - Reflected Cross-Site Scripting Patched CVE-2025-59012 6.1 Tran Nguyen Bao Khanh September 6, 2025
Travel Booking WordPress Theme < 3.2.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion Patched CVE-2025-59011 5.3 Tran Nguyen Bao Khanh September 6, 2025
Traveler < 3.2.2 - Unauthenticated SQL Injection Patched CVE-2025-52714 7.5 Frank July 10, 2025
Traveler <= 3.2.0 - Unauthenticated SQL Injection Patched CVE-2025-26898 7.5 Rafie Muhammad March 27, 2025
Traveler < 3.2.1 - Unauthenticated PHP Object Injection Patched CVE-2025-26873 9.8 Rafie Muhammad March 27, 2025
Traveler <= 3.2.0 - Missing Authorization Patched CVE-2025-26733 5.3 Rafie Muhammad March 27, 2025
Traveler <= 3.2.0 - Missing Authorization Patched CVE-2025-26956 4.3 Rafie Muhammad March 27, 2025
Traveler <= 3.1.8 - Reflected Cross-Site Scripting Patched CVE-2025-1773 6.1 István Márton March 14, 2025
Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post Patched CVE-2025-1771 9.8 István Márton March 14, 2025
Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode Patched CVE-2024-12811 8.8 István Márton February 27, 2025
Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions Patched CVE-2024-11926 6.5 Lucio Sá December 17, 2024
Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id Patched CVE-2024-11912 7.5 Lucio Sá December 17, 2024
Traveler – Travel Booking WordPress Theme < 2.8.4 - Cross-Site Scripting Patched 6.1 R3N0 June 23, 2020

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation