Travel Booking WordPress Theme

Travel Booking WordPress Theme has 25 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; 24 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 7.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 8 high. 2025 was the busiest year with 14 disclosures.

The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 7 of the records (28%). Other recurring categories include Improper Neutralization Of Special Elements Used In An SQL Command, Missing Authorization.

24 of the records (96%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

8 independent researchers contributed these findings, most of them (6) reported by Rafie Muhammad.

01234567891005.05.2019Today05.05.20196.4Travel Booking WordPress Theme < 2.7.8.4 - Cross-Site Scripting CVSS 6.4 · 05.05.201913.01.20208.3Traveler – Travel Booking WordPress Theme < 2.7.8.6 - Cross-Site Scripting CVSS 8.3 · 13.01.202017.06.20206.1Travel Booking WordPress Theme < 2.8.2 - Cross-Site Scripting CVSS 6.1 · 17.06.202023.06.20206.1Traveler – Travel Booking WordPress Theme < 2.8.4 - Cross-Site Scripting CVSS 6.1 · 23.06.20209.8Travel Booking WordPress Theme < 2.8.4 - SQL Injection CVSS 9.8 · 23.06.202017.12.20246.5Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions CVSS 6.5 · 17.12.20247.5Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id CVSS 7.5 · 17.12.202427.02.20258.8Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode CVSS 8.8 · 27.02.202514.03.20256.1Traveler <= 3.1.8 - Reflected Cross-Site Scripting CVSS 6.1 · 14.03.20259.8Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post CVSS 9.8 · 14.03.202527.03.20257.5Traveler <= 3.2.0 - Unauthenticated SQL Injection CVSS 7.5 · 27.03.20259.8Traveler < 3.2.1 - Unauthenticated PHP Object Injection CVSS 9.8 · 27.03.20254.3Traveler <= 3.2.0 - Missing Authorization CVSS 4.3 · 27.03.20255.3Traveler <= 3.2.0 - Missing Authorization CVSS 5.3 · 27.03.202510.07.20257.5Traveler < 3.2.2 - Unauthenticated SQL Injection CVSS 7.5 · 10.07.202506.09.20256.1Travel Booking WordPress Theme < 3.2.3 - Reflected Cross-Site Scripting CVSS 6.1 · 06.09.20255.3Travel Booking WordPress Theme < 3.2.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion CVSS 5.3 · 06.09.202506.11.20258.1Traveler < 3.2.6 - Unauthenticated Local File Inclusion CVSS 8.1 · 06.11.202507.11.20255.3Traveler <= 3.2.6 - Missing Authorization CVSS 5.3 · 07.11.20256.1Traveler < 3.2.6 - Reflected Cross-Site Scripting CVSS 6.1 · 07.11.20256.5Traveler < 3.2.6 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 07.11.202505.01.20265.3Traveler <= 3.2.6 - Missing Authorization CVSS 5.3 · 05.01.202622.01.20266.5Traveler < 3.2.8 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 22.01.202617.03.20268.1Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection CVSS 8.1 · 17.03.202606.10.20267.5Travel Booking WordPress Theme <= 3.2.9 - Unauthenticated SQL Injection CVSS 7.5 · 06.10.2026

Strategic Overview

Avg CVSSMedium
7.0/ 10
Patch Coverage96%
Open

1

Fixed

24

Get automatic notifications for all Travel Booking WordPress Theme vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2025-63028

Traveler <= 3.2.6 - Missing Authorization

Read the full analysis

Vulnerability Records

25 records
2026-10-06 00:00
Travel Booking WordPress Theme <= 3.2.9 - Unauthenticated SQL Injection
Travel Booking WordPress Theme
<= 3.2.9
CVE-2026-93947
7.5
High
Rafie MuhammadYes
2026-03-17 00:00
Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection
Travel Booking WordPress Theme
< 3.2.8.1
CVE-2026-25449
8.1
High
Phat RiOYes
2026-01-22 00:00
Traveler < 3.2.8 - Authenticated (Contributor+) SQL Injection
Travel Booking WordPress Theme
< 3.2.8
CVE-2026-24367
6.5
Medium
João Pedro Soares de AlcântaraYes
2026-01-05 00:00
Traveler <= 3.2.6 - Missing Authorization
Travel Booking WordPress Theme
<= 3.2.6
CVE-2025-67917
5.3
Medium
Rafie MuhammadYes
2025-11-07 00:00
Traveler <= 3.2.6 - Missing Authorization
Travel Booking WordPress Theme
<= 3.2.6
CVE-2025-63028
5.3
Medium
João Pedro Soares de AlcântaraNo
2025-11-07 00:00
Traveler < 3.2.6 - Reflected Cross-Site Scripting
Travel Booking WordPress Theme
< 3.2.6
CVE-2025-64372
6.1
Medium
João Pedro Soares de AlcântaraYes
2025-11-07 00:00
Traveler < 3.2.6 - Authenticated (Subscriber+) SQL Injection
Travel Booking WordPress Theme
< 3.2.6
CVE-2025-64371
6.5
Medium
João Pedro Soares de AlcântaraYes
2025-11-06 00:00
Traveler < 3.2.6 - Unauthenticated Local File Inclusion
Travel Booking WordPress Theme
< 3.2.6
CVE-2025-64373
8.1
High
João Pedro Soares de AlcântaraYes
2025-09-06 00:00
Travel Booking WordPress Theme < 3.2.3 - Reflected Cross-Site Scripting
Travel Booking WordPress Theme
< 3.2.3
CVE-2025-59012
6.1
Medium
Tran Nguyen Bao KhanhYes
2025-09-06 00:00
Travel Booking WordPress Theme < 3.2.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Travel Booking WordPress Theme
< 3.2.3
CVE-2025-59011
5.3
Medium
Tran Nguyen Bao KhanhYes
Showing 1–10 of 25 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C