CozyStay - Hotel Booking WordPress Theme

CozyStay - Hotel Booking WordPress Theme has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 3 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (33%). Other recurring categories include PHP Remote File Inclusion, Cross-Site Scripting.

Every one of the 6 issues recorded for CozyStay - Hotel Booking WordPress Theme has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Bonds.

Strategic Overview

Avg CVSSHigh

8.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all CozyStay - Hotel Booking WordPress Theme vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-49508

CozyStay < 1.7.1 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

6 records


2026-08-25 00:00	CozyStay - Hotel Booking WordPress Theme <= 1.10.0 - Unauthenticated Stored Cross-Site Scripting CozyStay - Hotel Booking WordPress Theme <= 1.10.0	`CVE-2026-78289`	7.2 High	G0053	Yes
2026-02-05 00:00	CozyStay < 1.9.1 - Unauthenticated Local File Inclusion CozyStay - Hotel Booking WordPress Theme < 1.9.1	`CVE-2025-67988`	8.1 High	João Pedro Soares de Alcântara	Yes
2025-06-11 00:00	CozyStay < 1.7.1 - Unauthenticated Local File Inclusion CozyStay - Hotel Booking WordPress Theme < 1.7.1	`CVE-2025-49508`	9.8 Critical	Bonds	Yes
2025-06-09 00:00	CozyStay < 1.7.1 - Unauthenticated PHP Object Injection CozyStay - Hotel Booking WordPress Theme < 1.7.1	`CVE-2025-49507`	9.8 Critical	Bonds	Yes
2025-03-18 00:00	CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler CozyStay - Hotel Booking WordPress Theme <= 1.7.0	`CVE-2024-13410`	9.8 Critical	Lucio Sá	Yes
2025-03-18 00:00	CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler CozyStay - Hotel Booking WordPress Theme <= 1.7.0	`CVE-2024-13412`	7.5 High	Lucio Sá	Yes

Showing 1–6 of 6 reports