Themefic vulnerabilities
58 CVEs and advisories name Themefic as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-100386Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser
- CVE-2026-102435Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
- CVE-2026-97470Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
- CVE-2026-103480Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
- CVE-2026-103999Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
- CVE-2026-96833WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
- CVE-2026-82901Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
- CVE-2026-95586WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-15948Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
- CVE-2026-28188WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-28186WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability
- CVE-2026-27999WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability
- CVE-2026-12801Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
- CVE-2026-65439WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57395WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability
- CVE-2026-57392WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability
- CVE-2026-57388WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-12433Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
- CVE-2026-56064WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability
- CVE-2026-12937Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter
- CVE-2026-39594WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability
- CVE-2026-42675WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability
- CVE-2026-39571WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability
- CVE-2026-39543WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability
- CVE-2026-39541WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32460WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24945WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability
- CVE-2026-24940WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability
- CVE-2025-68027WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability
- CVE-2025-68055WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability