Villatheme vulnerabilities
80 CVEs and advisories name Villatheme as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121775WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability
- CVE-2026-122663WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability
- CVE-2026-110251Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter
- CVE-2026-112827WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-111404WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability
- CVE-2026-112839WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability
- CVE-2026-110377WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability
- CVE-2026-110376WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-103081WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability
- CVE-2026-103358WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability
- CVE-2026-103080WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
- CVE-2026-103356WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability
- CVE-2026-103685WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability
- CVE-2026-104398WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability
- CVE-2026-103071WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability
- CVE-2026-103357WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability
- CVE-2026-100161Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
- CVE-2026-103072WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability
- CVE-2026-97275WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability
- CVE-2026-100515WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102383WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability
- CVE-2026-97071WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability
- CVE-2026-101923Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
- CVE-2026-100517WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-102379WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability
- CVE-2026-102390WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability
- CVE-2026-94171WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97261WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability
- CVE-2026-81786WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-81282WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability