ShineTheme vulnerabilities

We track 15 vulnerabilities in ShineTheme products across 3 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2026.

15vulnerabilities

6critical

9high

0exploited

8.5average CVSS score

Latest ShineTheme vulnerabilities

9.3 Critical severity
Traveler: Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-93947Oct 9, 2026ShineTheme
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
9.8 Critical severity
Traveler: Deserialization of Untrusted Data
CVE-2026-25449Mar 18, 2026ShineTheme
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
8.5 High severity
Traveler: Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-24367Jan 22, 2026ShineTheme
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.
8.1 High severity
Traveler: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-64373Dec 18, 2025ShineTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.
7.1 High severity
Traveler: Improper Neutralization of Input During Web Page Generation
CVE-2025-64372Dec 18, 2025ShineTheme
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.
8.5 High severity
Traveler: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-64371Dec 18, 2025ShineTheme
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.
7.1 High severity
Traveler: Improper Neutralization of Input During Web Page Generation
CVE-2025-59012Sep 26, 2025ShineTheme
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.
7.5 High severity
Traveler: Missing Authorization
CVE-2025-59011Sep 26, 2025ShineTheme
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.
9.3 Critical severity
Traveler: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-52714Jul 16, 2025ShineTheme
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.
9.3 Critical severity
Traveler: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-26898Mar 27, 2025ShineTheme
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
9.8 Critical severity
Travel Booking WordPress Theme: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-1771Mar 15, 2025ShineTheme
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbi
8.8 High severity
Travel Booking WordPress Theme: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2024-12811Feb 28, 2025ShineTheme
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrar
8.5 High severity
Traveler Code: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-22700Feb 4, 2025ShineTheme
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.3.
9.0 Critical severity
Traveler Code: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-22699Feb 4, 2025ShineTheme
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.
7.5 High severity
Travel Booking WordPress Theme: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-11912Dec 18, 2024ShineTheme
The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient p