The Traveler WordPress theme contains insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts via multiple URL parameters. When a victim follows a crafted link, the malicious script runs in the victim’s browser. The vulnerability is classified as CWE‑79 and does not provide direct code execution, but it enables attackers to execute scripts in users’ browsers.

All installations of the ShineTheme Travel Booking WordPress theme with a version of 3.1.8 or earlier are affected. The vulnerability applies to every instance that has not been upgraded beyond 3.1.8.

The CVSS score of 6.1 indicates a medium severity, while the EPSS score of < 1 % shows a very low exploitation probability at any given time. The vulnerability is not listed in the CISA KEV catalog. Attackers could construct a URL containing malicious query parameters and rely on social engineering (e.g., phishing emails or compromised sites) to get a user to click it, thereby executing the embedded script.