Improper neutralization of user input in the shinetheme Traveler WordPress theme allows reflected XSS, enabling an attacker to inject and execute arbitrary JavaScript in a victim’s browser. This can lead to session hijacking, defacement, or the execution of malicious payloads within the user’s context. The weakness corresponds to CWE‑79.

The vulnerability is present in the shinetheme Traveler theme from its inception up to, but not including, version 3.2.3. All deployments of the shinetheme Traveler theme falling in that range are affected, regardless of WordPress core version.

The CVSS score of 7.1 classifies the issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the flaw is not listed in CISA’s KEV catalog, meaning no confirmed exploitation has been observed. Based on the description, the likely attack vector is inferred to involve any user‑supplied input rendered by the theme, such as URL query parameters or form fields, which attackers could manipulate to deliver malicious scripts.