Golo - City Travel Guide WordPress Theme

Golo - City Travel Guide WordPress Theme has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; 7 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 2 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (38%). Other recurring categories include Missing Authorization, Authentication Bypass Using An Alternate Path Or Channel.

7 of the records (88%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

6 independent researchers contributed these findings, most of them (3) reported by João Pedro Soares de Alcântara.

Strategic Overview

Avg CVSSHigh

7.7/ 10

Patch Coverage88%

Open

Fixed

Get automatic notifications for all Golo - City Travel Guide WordPress Theme vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2026-27051

Golo - City Travel Guide WordPress Theme <= 1.7.0 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

8 records


2026-03-23 00:00	Golo - City Travel Guide WordPress Theme < 1.7.5 - Reflected Cross-Site Scripting Golo - City Travel Guide WordPress Theme < 1.7.5	`CVE-2026-23973`	6.1 Medium	João Pedro Soares de Alcântara	Yes
2026-03-12 00:00	Golo - City Travel Guide WordPress Theme <= 1.7.0 - Unauthenticated Privilege Escalation Golo - City Travel Guide WordPress Theme <= 1.7.0	`CVE-2026-27051`	9.8 Critical	Tran Nguyen Bao Khanh	No
2026-02-05 00:00	Golo < 1.7.5 - Authenticated (Contributor+) Local File Inclusion Golo - City Travel Guide WordPress Theme < 1.7.5	`CVE-2026-23975`	7.5 High	João Pedro Soares de Alcântara	Yes
2026-02-05 00:00	Golo < 1.7.5 - Missing Authorization Golo - City Travel Guide WordPress Theme < 1.7.5	`CVE-2026-23974`	5.3 Medium	João Pedro Soares de Alcântara	Yes
2025-08-26 00:00	Golo <= 1.7.1 - Reflected Cross-Site Scripting Golo - City Travel Guide WordPress Theme <= 1.7.1	`CVE-2025-54724`	6.1 Medium	Bonds	Yes
2025-06-02 16:21	Golo <= 1.7.0 - Authentication Bypass to Account Takeover Golo - City Travel Guide WordPress Theme <= 1.7.0	`CVE-2025-4797`	9.8 Critical	Foxyyy	Yes
2025-03-06 00:00	Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change Golo - City Travel Guide WordPress Theme <= 1.6.10	`CVE-2024-12876`	9.8 Critical	Lucio Sá	Yes
2020-07-11 00:00	Golo - City Travel Guide WordPress Theme < 1.3.3 - Reflected Cross-Site Scripting Golo - City Travel Guide WordPress Theme < 1.3.3	`N/A`	7.1 High	R3N0	Yes

Showing 1–8 of 8 reports