Travel Monster Vulnerabilities

The Travel Monster theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.3.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.3.3

Fixed in:

1.3.4

Disclosed:

Jan 13, 2026

CVE-2026-24607 on NVD →

The Travel Monster theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the travel_monster_update_admin_notice() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged requ...

CVSS:

4.3

Affected:

up to 1.1.2

Fixed in:

1.1.3

Disclosed:

Jun 27, 2024

CVE-2024-37272 on NVD →