Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

26 results

Oct 9, 2026Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-93947 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
Product
Traveler
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 18, 2026Traveler: Deserialization of Untrusted DataCVE-2026-25449 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24367 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Traveler: Missing AuthorizationCVE-2025-67917 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
Product
Traveler
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025Backpack Traveler: Authorization Bypass Through User-Controlled KeyCVE-2025-69030 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.
Product
Backpack Traveler
Affected
up to 2.10.3
What to do
Affects up to 2.10.3. Update Backpack Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64373 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64371 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Traveler Option Tree: Insertion of Sensitive Information Into Sent DataCVE-2025-49300 · WordPress plugins & themes · reported by PatchstackLow 2.7
Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.
Product
Traveler Option Tree
Affected
up to 2.8
What to do
Affects up to 2.8. Update Traveler Option Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Traveler: Missing AuthorizationCVE-2025-63028 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
Product
Traveler
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Travelers' Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS.This issue affects Travelers' Map: from n/a through <= 2.3.2.
Product
Travelers' Map
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Travelers' Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59012 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Traveler: Missing AuthorizationCVE-2025-59011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52714 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025Backpack Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39490 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows PHP Local File Inclusion.This issue affects Backpack Traveler: from n/a through <= 2.10.2.
Product
Backpack Traveler
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update Backpack Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26956 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26898 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Traveler: Deserialization of Untrusted DataCVE-2025-26873 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26733 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Traveler: Reflected Cross-Site ScriptingCVE-2025-1773 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Traveler
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Mar 15, 2025Traveler: Local File InclusionCVE-2025-1771 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Traveler
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Feb 27, 2025Traveler: Local File InclusionCVE-2024-12811 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Traveler
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22700 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.3.
Product
Traveler Code
What to do
Update Traveler Code to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22699 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.
Product
Traveler Code
What to do
Update Traveler Code to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Traveler Layout Essential For Elementor: Server-Side Request Forgery (SSRF)CVE-2025-22701 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through < 1.4.
Product
Traveler Layout Essential For Elementor
What to do
Update Traveler Layout Essential For Elementor to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 27, 2024Travelers' Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29909 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille Verrier Travelers' Map allows Stored XSS.This issue affects Travelers' Map: from n/a through 2.2.0.
Product
Travelers' Map
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Travelers' Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.