# cve.now: Themefic

The newest entries naming Themefic as an affected vendor (up to 200), of 58 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-100386](https://cve.now/CVE-2026-100386.md): Ultra Addons for Contact Form 7 \<= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser (CVSS 7.5)
- [CVE-2026-102435](https://cve.now/CVE-2026-102435.md): Ultra Addons for Contact Form 7 \<= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field (CVSS 9.8)
- [CVE-2026-97470](https://cve.now/CVE-2026-97470.md): Tourfic \<= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered\_html Grant to Customer Role (CVSS 6.4)
- [CVE-2026-103480](https://cve.now/CVE-2026-103480.md): Tourfic \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-103999](https://cve.now/CVE-2026-103999.md): Ultra Addons for Contact Form 7 \<= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 7.2)
- [CVE-2026-96833](https://cve.now/CVE-2026-96833.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.5.51 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-82901](https://cve.now/CVE-2026-82901.md): Ultra Addons for Contact Form 7 \<= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field (CVSS 9.8)
- [CVE-2026-95586](https://cve.now/CVE-2026-95586.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.5.50 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-15948](https://cve.now/CVE-2026-15948.md): Hydra Booking \<= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first\_name' Parameter (CVSS 6.4)
- [CVE-2026-28188](https://cve.now/CVE-2026-28188.md): WordPress Hydra Booking plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2026-28186](https://cve.now/CVE-2026-28186.md): WordPress Travelfic Toolkit plugin \<= 1.5.1 - Broken Access Control vulnerability (CVSS 8.1)
- [CVE-2026-27999](https://cve.now/CVE-2026-27999.md): WordPress Tourfic plugin \<= 2.23.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-12801](https://cve.now/CVE-2026-12801.md): Ultra Addons for Contact Form 7 \<= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes (CVSS 6.4)
- [CVE-2026-65439](https://cve.now/CVE-2026-65439.md): WordPress Ultimate Addons for Contact Form 7 plugin \<=3.5.45 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57395](https://cve.now/CVE-2026-57395.md): WordPress Tourfic plugin \<= 2.22.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-57392](https://cve.now/CVE-2026-57392.md): WordPress Tourfic plugin \<= 2.22.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-57388](https://cve.now/CVE-2026-57388.md): WordPress Hydra Booking plugin \<= 1.1.44 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-12433](https://cve.now/CVE-2026-12433.md): Hydra Booking \<= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking\_id' Parameter (CVSS 4.3)
- [CVE-2026-56064](https://cve.now/CVE-2026-56064.md): WordPress Tourfic plugin \<= 2.22.5 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-12937](https://cve.now/CVE-2026-12937.md): Tourfic \<= 2.22.7 - Unauthenticated SQL Injection via 'post\_id' Parameter (CVSS 7.5)
- [CVE-2026-39594](https://cve.now/CVE-2026-39594.md): WordPress Ultra Addons for WPForms plugin \<= 1.0.11 - Broken Access Control vulnerability (CVSS 6.4)
- [CVE-2026-42675](https://cve.now/CVE-2026-42675.md): WordPress Hydra Booking plugin \<= 1.1.41 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2026-39571](https://cve.now/CVE-2026-39571.md): WordPress Instantio plugin \<= 3.3.30 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-39543](https://cve.now/CVE-2026-39543.md): WordPress Tourfic plugin \<= 2.21.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-39541](https://cve.now/CVE-2026-39541.md): WordPress Hydra Booking plugin \<= 1.1.38 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-32460](https://cve.now/CVE-2026-32460.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.5.36 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-24945](https://cve.now/CVE-2026-24945.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.5.34 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-24940](https://cve.now/CVE-2026-24940.md): WordPress Travelfic Toolkit plugin \<= 1.3.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-68027](https://cve.now/CVE-2025-68027.md): WordPress Hydra Booking plugin \<= 1.1.32 - Privilege Escalation vulnerability (CVSS 7.3)
- [CVE-2025-68055](https://cve.now/CVE-2025-68055.md): WordPress Hydra Booking plugin \<= 1.1.32 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-14356](https://cve.now/CVE-2025-14356.md): Ultra Addons for Contact Form 7 \<= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF (CVSS 4.3)
- [CVE-2025-12788](https://cve.now/CVE-2025-12788.md): Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings \<= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass (CVSS 5.3)
- [CVE-2025-12787](https://cve.now/CVE-2025-12787.md): Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings \<= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation (CVSS 5.3)
- [CVE-2025-49378](https://cve.now/CVE-2025-49378.md): WordPress Hydra Booking plugin \<= 1.1.10 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-49377](https://cve.now/CVE-2025-49377.md): WordPress Hydra Booking plugin \<= 1.1.9 - Broken Access Control vulnerability (CVSS 6.3)
- [CVE-2024-8860](https://cve.now/CVE-2024-8860.md): Tourfic \<= 2.14.5 - Missing Authorization in Multiple Functions (CVSS 4.3)
- [CVE-2025-7689](https://cve.now/CVE-2025-7689.md): Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb\_reset\_password\_callback Function (CVSS 8.8)
- [CVE-2025-6756](https://cve.now/CVE-2025-6756.md): Ultra Addons for Contact Form 7 \<= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7\_CUSTOM\_FIELDS Shortcode (CVSS 6.4)
- [CVE-2025-6212](https://cve.now/CVE-2025-6212.md): Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module (CVSS 7.2)
- [CVE-2025-6220](https://cve.now/CVE-2025-6220.md): Ultimate Addons for Contact Form 7 \<= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save\_options' (CVSS 7.2)
- [CVE-2025-49323](https://cve.now/CVE-2025-49323.md): WordPress Hydra Booking plugin \<= 1.1.10 - SQL Injection Vulnerability (CVSS 8.5)
- [CVE-2025-47550](https://cve.now/CVE-2025-47550.md): WordPress Instantio plugin \<= 3.3.16 - Arbitrary File Upload Vulnerability (CVSS 6.6)
- [CVE-2025-47549](https://cve.now/CVE-2025-47549.md): WordPress BEAF plugin \<= 4.6.10 - Arbitrary File Upload Vulnerability (CVSS 9.1)
- [CVE-2025-24581](https://cve.now/CVE-2025-24581.md): WordPress Instantio plugin \<= 3.3.7 - Settings Change vulnerability (CVSS 6.5)
- [CVE-2025-39585](https://cve.now/CVE-2025-39585.md): WordPress Travelfic Toolkit plugin \<= 1.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-24650](https://cve.now/CVE-2025-24650.md): WordPress Tourfic plugin \<= 2.15.3 - Arbitrary File Upload vulnerability (CVSS 9.1)
- [CVE-2023-47693](https://cve.now/CVE-2023-47693.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.2.6 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2024-12032](https://cve.now/CVE-2024-12032.md): Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking \<= 2.15.3 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2024-8319](https://cve.now/CVE-2024-8319.md): Tourfic \<= 2.11.20 - Cross-Site Request Forgery in Multiple Functions (CVSS 4.3)
- [CVE-2024-32433](https://cve.now/CVE-2024-32433.md): WordPress BEAF plugin \<= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-29134](https://cve.now/CVE-2024-29134.md): WordPress Tourfic plugin \<= 2.11.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-29135](https://cve.now/CVE-2024-29135.md): WordPress Tourfic plugin \<= 2.11.15 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2024-29136](https://cve.now/CVE-2024-29136.md): WordPress Tourfic plugin \<= 2.11.17 - PHP Object Injection vulnerability (CVSS 8.5)
- [CVE-2024-29137](https://cve.now/CVE-2024-29137.md): WordPress Tourfic plugin \<= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2023-30495](https://cve.now/CVE-2023-30495.md): WordPress Ultimate Addons for Contact Form 7 Plugin \<= 3.1.23 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-49766](https://cve.now/CVE-2023-49766.md): WordPress Ultimate Addons for Contact Form 7 Plugin \<= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-30493](https://cve.now/CVE-2023-30493.md): WordPress Ultimate Addons for Contact Form 7 Plugin \<= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2022-47586](https://cve.now/CVE-2022-47586.md): WordPress Ultimate Addons for Contact Form 7 Plugin \<= 3.1.23 is vulnerable to SQL Injection (CVSS 8.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themefic
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.