Travel Booking Vulnerabilities

The Travel Booking theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may ma...

CVSS:

4.3

Affected:

up to 2.2.5

Fixed in:

2.2.6

Disclosed:

Jun 25, 2026

CVE-2026-56059 on NVD →

The Travel Booking theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.3.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.3.9

Fixed in:

1.4.0

Disclosed:

Feb 9, 2026

CVE-2026-32486 on NVD →

Multiple themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'id' parameter found in the '[different-value]_customizer_notify_dismiss_action' and '[different-value]_customizer_notify_dismiss_recommended_plugins' AJAX actions in various versions due to insufficient input sanitization and output...

CVSS:

6.1

Affected:

up to 1.2.3

Fixed in:

1.2.3

Disclosed:

Feb 14, 2022