Themefic vulnerabilities
58 CVEs and advisories name Themefic as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-14356Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF
- CVE-2025-12788Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
- CVE-2025-12787Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
- CVE-2025-49378WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerability
- CVE-2025-49377WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerability
- CVE-2024-8860Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions
- CVE-2025-7689Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
- CVE-2025-6756Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode
- CVE-2025-6212Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module
- CVE-2025-6220Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
- CVE-2025-49323WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection Vulnerability
- CVE-2025-47550WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability
- CVE-2025-47549WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability
- CVE-2025-24581WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerability
- CVE-2025-39585WordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-24650WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability
- CVE-2023-47693WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability
- CVE-2024-12032Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-8319Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions
- CVE-2024-32433WordPress BEAF plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-29134WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29135WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability
- CVE-2024-29136WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability
- CVE-2024-29137WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-30495WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection
- CVE-2023-49766WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-30493WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2022-47586WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection