An unauthenticated reflected Cross Site Scripting (XSS) vulnerability exists in the Trendy Travel WordPress theme version 6.7 and earlier. The flaw permits an attacker to inject and execute arbitrary JavaScript code within a victim’s browser when the user views a crafted page or submits a manipulated request. This weakness, classified as CWE‑79, can compromise the confidentiality, integrity, or availability of the site’s users by enabling malicious scripts to run under the visitor’s context.

DesignThemes’s Trendy Travel WordPress theme 6.7 and earlier are impacted. Any WordPress installation that has the theme installed at or below version 6.7 remains vulnerable until the theme is upgraded to a version that addresses the flaw.

The CVSS score of 7.1 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is remote; an attacker can trigger the flaw by delivering a malicious link or form input to a site visitor, leading the browser to execute the injected script.