Villatheme vulnerabilities
80 CVEs and advisories name Villatheme as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-82227WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability
- CVE-2026-81277WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability
- CVE-2026-57698WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability
- CVE-2026-57422WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-11778CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
- CVE-2026-57352WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability
- CVE-2026-57664WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerability
- CVE-2026-57324WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-54809WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability
- CVE-2026-39593WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-40737WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-32526WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-28132WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability
- CVE-2025-67977WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability
- CVE-2026-27052WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability
- CVE-2026-2019Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting
- CVE-2025-14541Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
- CVE-2025-14509Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags
- CVE-2025-68550WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability
- CVE-2025-68556WordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability
- CVE-2025-14581HAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply
- CVE-2025-66528WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability
- CVE-2025-49372WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability
- CVE-2025-64200WordPress Email Template Customizer for WooCommerce plugin <= 1.2.17 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-47570WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-53571WordPress HAPPY plugin <= 1.0.6 - Broken Access Control vulnerability
- CVE-2025-30993WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Broken Access Control Vulnerability
- CVE-2025-47563WordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerability
- CVE-2024-13320CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection
- CVE-2024-13487CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function