# cve.now: Villatheme

The newest entries naming Villatheme as an affected vendor (up to 200), of 80 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121775](https://cve.now/CVE-2026-121775.md): WordPress CURCY plugin \<= 2.2.20 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-122663](https://cve.now/CVE-2026-122663.md): WordPress CURCY plugin \<= 2.2.20 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-110251](https://cve.now/CVE-2026-110251.md): Photo Reviews for WooCommerce \<= 1.2.31 - Unauthenticated File Deletion via 'wcpr\_image\_upload\_id' Parameter (CVSS 5.4)
- [CVE-2026-112827](https://cve.now/CVE-2026-112827.md): WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2026-111404](https://cve.now/CVE-2026-111404.md): WordPress Photo Reviews for WooCommerce plugin \<= 1.2.31 - Race Condition vulnerability (CVSS 3.7)
- [CVE-2026-112839](https://cve.now/CVE-2026-112839.md): WordPress Customer Coupons for WooCommerce plugin \<= 1.3.14 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-110377](https://cve.now/CVE-2026-110377.md): WordPress Bopo – WooCommerce Product Bundle Builder plugin \<= 1.2.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-110376](https://cve.now/CVE-2026-110376.md): WordPress DEPART plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-103081](https://cve.now/CVE-2026-103081.md): WordPress Salevo plugin \<= 1.3.0 - Content Injection vulnerability (CVSS 7.5)
- [CVE-2026-103358](https://cve.now/CVE-2026-103358.md): WordPress Email Template Customizer for WooCommerce plugin \<= 1.3.4 - Content Injection vulnerability (CVSS 7.5)
- [CVE-2026-103080](https://cve.now/CVE-2026-103080.md): WordPress Salevo plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-103356](https://cve.now/CVE-2026-103356.md): WordPress TMDS plugin \<= 1.0.15 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-103685](https://cve.now/CVE-2026-103685.md): WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-104398](https://cve.now/CVE-2026-104398.md): WordPress AFFI – Affiliate Marketing for WooCommerce plugin \<= 1.0.10 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-103071](https://cve.now/CVE-2026-103071.md): WordPress Thank You Page Customizer for WooCommerce plugin \<= 1.2.3 - Content Injection vulnerability (CVSS 7.5)
- [CVE-2026-103357](https://cve.now/CVE-2026-103357.md): WordPress GIFT4U plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 6.9)
- [CVE-2026-100161](https://cve.now/CVE-2026-100161.md): Photo Reviews for WooCommerce \<= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr\_image\_upload\_id' Parameter (CVSS 7.2)
- [CVE-2026-103072](https://cve.now/CVE-2026-103072.md): WordPress VillaTheme Core plugin \<= 1.0.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-97275](https://cve.now/CVE-2026-97275.md): WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin \<= 1.0.28 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2026-100515](https://cve.now/CVE-2026-100515.md): WordPress Photo Reviews for WooCommerce plugin \<= 1.2.30 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-102383](https://cve.now/CVE-2026-102383.md): WordPress Lookzy plugin \<= 1.1.14 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-97071](https://cve.now/CVE-2026-97071.md): WordPress CURCY plugin \<= 2.2.17 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-101923](https://cve.now/CVE-2026-101923.md): Photo Reviews for WooCommerce \<= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr\_image\_upload\_id' Parameter (CVSS 8.1)
- [CVE-2026-100517](https://cve.now/CVE-2026-100517.md): WordPress Photo Reviews for WooCommerce plugin \<= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5)
- [CVE-2026-102379](https://cve.now/CVE-2026-102379.md): WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin \<= 1.0.28 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-102390](https://cve.now/CVE-2026-102390.md): WordPress AFFI – Affiliate Marketing for WooCommerce plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-94171](https://cve.now/CVE-2026-94171.md): WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97261](https://cve.now/CVE-2026-97261.md): WordPress Notivo plugin \<= 1.4.2 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-81786](https://cve.now/CVE-2026-81786.md): WordPress Thank You Page Customizer for WooCommerce plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-81282](https://cve.now/CVE-2026-81282.md): WordPress Product Variations Swatches for WooCommerce plugin \<= 1.1.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-82227](https://cve.now/CVE-2026-82227.md): WordPress WPBulky plugin \<= 1.2.2 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-81277](https://cve.now/CVE-2026-81277.md): WordPress Suggestion Engine for WooCommerce plugin \<= 2.0.11 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-57698](https://cve.now/CVE-2026-57698.md): WordPress Abandoned Cart Recovery for WooCommerce plugin \<= 1.1.12 - Broken Authentication vulnerability (CVSS 6.5)
- [CVE-2026-57422](https://cve.now/CVE-2026-57422.md): WordPress Bopo – WooCommerce Product Bundle Builder plugin \<= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-11778](https://cve.now/CVE-2026-11778.md): CURCY \<= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter (CVSS 5.4)
- [CVE-2026-57352](https://cve.now/CVE-2026-57352.md): WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin \<= 2.2.0 - Broken Authentication vulnerability (CVSS 4.8)
- [CVE-2026-57664](https://cve.now/CVE-2026-57664.md): WordPress Bopo – WooCommerce Product Bundle Builder plugin \<= 1.1.6 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2026-57324](https://cve.now/CVE-2026-57324.md): WordPress GIFT4U plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-54809](https://cve.now/CVE-2026-54809.md): WordPress GIFT4U plugin \<= 1.0.10 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-39593](https://cve.now/CVE-2026-39593.md): WordPress HAPPY plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-40737](https://cve.now/CVE-2026-40737.md): WordPress COMPE plugin \<= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-32526](https://cve.now/CVE-2026-32526.md): WordPress Abandoned Cart Recovery for WooCommerce plugin \<= 1.1.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-28132](https://cve.now/CVE-2026-28132.md): WordPress WooCommerce Photo Reviews plugin \<= 1.4.4 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2025-67977](https://cve.now/CVE-2025-67977.md): WordPress HAPPY plugin \<= 1.0.8 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2026-27052](https://cve.now/CVE-2026-27052.md): WordPress Sales Countdown Timer for WooCommerce and WordPress plugin \< 1.1.9 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-2019](https://cve.now/CVE-2026-2019.md): Cart All In One For WooCommerce \<= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc\_assign\_page' Setting (CVSS 7.2)
- [CVE-2025-14541](https://cve.now/CVE-2025-14541.md): Lucky Wheel Giveaway \<= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional\_tags' Parameter (CVSS 7.2)
- [CVE-2025-14509](https://cve.now/CVE-2025-14509.md): Lucky Wheel for WooCommerce – Spin a Sale \<= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags (CVSS 7.2)
- [CVE-2025-68550](https://cve.now/CVE-2025-68550.md): WordPress WPBulky plugin \<= 1.1.13 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-68556](https://cve.now/CVE-2025-68556.md): WordPress HAPPY plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-14581](https://cve.now/CVE-2025-14581.md): HAPPY – Helpdesk Support Ticket System \<= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply (CVSS 4.3)
- [CVE-2025-66528](https://cve.now/CVE-2025-66528.md): WordPress Thank You Page Customizer for WooCommerce plugin \<= 1.1.8 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-49372](https://cve.now/CVE-2025-49372.md): WordPress HAPPY plugin \<= 1.0.7 - Remote Code Execution (RCE) vulnerability (CVSS 10.0)
- [CVE-2025-64200](https://cve.now/CVE-2025-64200.md): WordPress Email Template Customizer for WooCommerce plugin \<= 1.2.17 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-47570](https://cve.now/CVE-2025-47570.md): WordPress WooCommerce Photo Reviews plugin \<= 1.3.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-53571](https://cve.now/CVE-2025-53571.md): WordPress HAPPY plugin \<= 1.0.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-30993](https://cve.now/CVE-2025-30993.md): WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales \<= 1.1.7 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-47563](https://cve.now/CVE-2025-47563.md): WordPress CURCY plugin \<= 2.3.7 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3)
- [CVE-2024-13320](https://cve.now/CVE-2024-13320.md): CURCY - WooCommerce Multi Currency - Currency Switcher \<= 2.3.6 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2024-13487](https://cve.now/CVE-2024-13487.md): CURCY – Multi Currency for WooCommerce \<= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get\_products\_price Function (CVSS 7.3)
- [CVE-2024-12861](https://cve.now/CVE-2024-12861.md): W2S – Migrate WooCommerce to Shopify \<= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5)
- [CVE-2025-22803](https://cve.now/CVE-2025-22803.md): WordPress Advanced Product Information for WooCommerce plugin \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2022-46796](https://cve.now/CVE-2022-46796.md): WordPress CURCY plugin \<= 2.1.25 - Unauthenticated plugin settings change vulnerability (CVSS 6.5)
- [CVE-2024-49283](https://cve.now/CVE-2024-49283.md): WordPress CURCY plugin \<= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-49288](https://cve.now/CVE-2024-49288.md): WordPress Email Template Customizer for WooCommerce plugin \<= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-8277](https://cve.now/CVE-2024-8277.md): WooCommerce Photo Reviews Premium \<= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation (CVSS 9.8)
- [CVE-2024-4039](https://cve.now/CVE-2024-4039.md): Orders Tracking for WooCommerce \<= 1.2.10 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5)
- [CVE-2024-1687](https://cve.now/CVE-2024-1687.md): Thank You Page Customizer for WooCommerce – Increase Your Sales \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4)
- [CVE-2024-1686](https://cve.now/CVE-2024-1686.md): Thank You Page Customizer for WooCommerce – Increase Your Sales \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export (CVSS 4.3)
- [CVE-2023-50831](https://cve.now/CVE-2023-50831.md): WordPress CURCY Plugin \<= 2.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-48778](https://cve.now/CVE-2023-48778.md): WordPress Product Size Chart For WooCommerce Plugin \<= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-30482](https://cve.now/CVE-2023-30482.md): WordPress WPBulky Plugin \< 1.0.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2021-4395](https://cve.now/CVE-2021-4395.md): Abandoned Cart Recovery for WooCommerce \<= 1.0.4 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2021-4379](https://cve.now/CVE-2021-4379.md): WooCommerce Multi Currency \<= 2.1.17 - Missing Authorization (CVSS 6.5)
- [CVE-2021-4376](https://cve.now/CVE-2021-4376.md): WooCommerce Multi Currency \<= 2.1.17 - Missing Authorization (CVSS 4.3)
- [CVE-2022-46810](https://cve.now/CVE-2022-46810.md): WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin \<= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-46812](https://cve.now/CVE-2022-46812.md): WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin \<= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-46806](https://cve.now/CVE-2022-46806.md): WordPress Cart All In One For WooCommerce Plugin \<= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2022-44634](https://cve.now/CVE-2022-44634.md): WordPress S2W – Import Shopify to WooCommerce plugin \<= 1.1.12 - Auth. Arbitrary File Read vulnerability (CVSS 4.9)
- [CVE-2022-41623](https://cve.now/CVE-2022-41623.md): WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin \<= 1.1.0 - Sensitive Data Exposure vulnerability (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/villatheme
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.