Advisories · Technology

ShineTheme Travel Booking WordPress Theme.

Every CVE that names ShineTheme Travel Booking WordPress Theme among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-1771 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post
- ShineTheme Travel Booking WordPress Theme
- File inclusion
Not analysed yet 15 Mar 2025
CVE-2025-1773 CVE record

CVSS 6.1 Medium

Traveler <= 3.1.8 - Reflected Cross-Site Scripting
- ShineTheme Travel Booking WordPress Theme
- Cross-site scripting (XSS)
Not analysed yet 15 Mar 2025
CVE-2024-12811 CVE record

CVSS 8.8 High

Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- ShineTheme Travel Booking WordPress Theme
- File inclusion
Not analysed yet 27 Feb 2025
CVE-2024-11912 CVE record

CVSS 7.5 High

Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id
- ShineTheme Travel Booking WordPress Theme
- SQL injection
Not analysed yet 18 Dec 2024
CVE-2024-11926 CVE record

CVSS 6.5 Medium

Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions
- ShineTheme Travel Booking WordPress Theme
- Broken access control
Not analysed yet 18 Dec 2024