Executive brief
The Trendy Travel theme for WordPress is vulnerable to a security flaw that allows attackers to inject malicious scripts into the website. This occurs because the theme does not properly sanitize user-provided data, potentially leading to unauthorized redirects, advertisement injection, or the theft of sensitive session information from visiting users. An exploit typically requires a victim to click a specially crafted link or visit a malicious page while the theme is active.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Trendy Travel theme for WordPress (versions <= 6.7) due to improper neutralization of user-supplied input (CWE-79). The flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of a victim's browser session. Exploitation requires network reachability and user interaction, such as a victim clicking a malicious link. As of the advisory date, no official patch has been released by the developer, though third-party mitigation rules are available.
Affected products
- designthemes Trendy Travel <= 6.7
Timeline
- 2025-11-07: other: Reported by researcher João Pedro S Alcântara (Kinorth)
- 2026-06-30: advisory: Initial advisory published by Patchstack
- 2026-07-02: disclosed: CVE published to NVD dataset