CVE-2025-69153 is an unauthenticated cross-site scripting (XSS) vulnerability in designthemes Trendy Travel software versions up to and including 6.7. The issue is due to improper neutralization of input during web page generation (CWE-79), which allows attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in partial disclosure of sensitive information, modification of data, and limited disruption of service. Because the vulnerability is exploitable without authentication, it poses a significant risk to users of affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewalls or input validation controls to mitigate exploitation. Monitor vendor communications for updates on patches or official mitigations.