Themefic vulnerabilities

Products

• Ultimate Addons For Contact Form 7 13
• Tourfic 11
• Ultimate Addons For Contact Form 7 10
• Hydra Booking 9
• Ultra Addons For Contact Form 7 9
• Hydra Booking — Appointment Scheduling & Booking Calendar 7
• Instantio 3
• Tourfic – Travel Booking, Hotel Booking & Car Rental Wordpress Plugin 3
• Travelfic Toolkit 3
• Beaf 2
• Tourfic – Ai Powered Travel Booking, Hotel Booking & Car Rental 2

Newest

• themefic ultra addons for contact form 7 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field CVE-2026-102435 9.8 CriticalNovember 2, 2026
• themefic tourfic – ai powered travel booking, hotel booking & car rental Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role CVE-2026-97470 6.4 MediumOctober 16, 2026
• themefic ultra addons for contact form 7 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload CVE-2026-103999 7.2 HighOctober 16, 2026
• themefic tourfic – ai powered travel booking, hotel booking & car rental Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute CVE-2026-103480 6.4 MediumOctober 16, 2026
• themefic ultimate addons for contact form 7 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability CVE-2026-96833 7.2 HighSeptember 30, 2026
• themefic ultra addons for contact form 7 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field CVE-2026-82901 Public exploit 9.8 CriticalSeptember 26, 2026
• themefic ultimate addons for contact form 7 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability CVE-2026-95586 6.5 MediumSeptember 23, 2026
• themefic hydra booking — appointment scheduling & booking calendar Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR CVE-2026-92425 5.5 MediumSeptember 19, 2026
• themefic hydra booking — appointment scheduling & booking calendar Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR CVE-2026-92421 4.7 MediumSeptember 19, 2026
• themefic hydra booking — appointment scheduling & booking calendar Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR CVE-2026-92420 3.8 LowSeptember 19, 2026
• themefic ultra addons for contact form 7 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field CVE-2026-84750 6.5 MediumSeptember 19, 2026
• themefic hydra booking — appointment scheduling & booking calendar Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-15948 6.4 MediumAugust 15, 2026
• themefic hydra booking WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability CVE-2026-28188 7.3 HighAugust 13, 2026
• themefic travelfic toolkit WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability CVE-2026-28186 8.1 HighAugust 13, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability CVE-2026-27999 6.5 MediumAugust 13, 2026
• themefic ultra addons for contact form 7 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes CVE-2026-12801 6.4 MediumAugust 7, 2026
• themefic ultimate addons for contact form 7 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability CVE-2026-65439 7.1 HighJuly 27, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability CVE-2026-57395 6.5 MediumJuly 13, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability CVE-2026-57392 6.5 MediumJuly 13, 2026
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability CVE-2026-57388 7.1 HighJuly 13, 2026
• themefic hydra booking — appointment scheduling & booking calendar Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter CVE-2026-12433 4.3 MediumJuly 9, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability CVE-2026-56064 8.5 HighJune 26, 2026
• themefic tourfic – ai powered travel booking, hotel booking & car rental wordpress plugin Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter CVE-2026-12937 7.5 HighJune 25, 2026
• themefic ultra addons for wpforms WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability CVE-2026-39594 6.4 MediumJune 15, 2026
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability CVE-2026-42675 7.3 HighJune 1, 2026
• themefic instantio WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability CVE-2026-39571 5.3 MediumApril 8, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability CVE-2026-39543 5.3 MediumApril 8, 2026
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability CVE-2026-39541 5.9 MediumApril 8, 2026
• themefic ultimate addons for contact form 7 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability CVE-2026-32460 6.5 MediumMarch 13, 2026
• themefic ultimate addons for contact form 7 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability CVE-2026-24945 5.3 MediumFebruary 3, 2026
• themefic travelfic toolkit WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability CVE-2026-24940 4.3 MediumFebruary 3, 2026
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability CVE-2025-68027 7.3 HighJanuary 22, 2026
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability CVE-2025-68055 Public exploit 8.5 HighDecember 16, 2025
• themefic ultra addons for contact form 7 Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF CVE-2025-14356 4.3 MediumDecember 12, 2025
• themefic hydra booking — appointment scheduling & booking calendar Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass CVE-2025-12788 5.3 MediumNovember 11, 2025
• themefic hydra booking — appointment scheduling & booking calendar Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generat… CVE-2025-12787 5.3 MediumNovember 11, 2025
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerability CVE-2025-49378 8.5 HighOctober 22, 2025
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerability CVE-2025-49377 6.3 MediumOctober 22, 2025
• themefic tourfic – travel booking, hotel booking & car rental wordpress plugin Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions CVE-2024-8860 4.3 MediumAugust 26, 2025
• themefic hydra booking – all in one appointment booking system | appointment scheduling, booking calendar & woocommerce bookings Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function CVE-2025-7689 8.8 HighJuly 29, 2025
• themefic ultra addons for contact form 7, ultimate addons for contact form 7 +1 more Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode CVE-2025-6756 6.4 MediumJuly 1, 2025
• themefic ultra addons for contact form 7, ultimate addons for contact form 7 +1 more Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module CVE-2025-6212 7.2 HighJune 26, 2025
• themefic ultimate addons for contact form 7, ultra addons for contact form 7 +1 more Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options' CVE-2025-6220 Public exploit 7.2 HighJune 18, 2025
• themefic hydra booking WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection Vulnerability CVE-2025-49323 8.5 HighJune 6, 2025
• themefic instantio WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability CVE-2025-47550 Public exploit 6.6 MediumMay 7, 2025
• binsaifullah beaf, themefic ultimate before after image slider \& gallery +1 more WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability CVE-2025-47549 Public exploit 9.1 CriticalMay 7, 2025
• themefic instantio WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerability CVE-2025-24581 6.5 MediumApril 17, 2025
• themefic travelfic toolkit WordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability CVE-2025-39585 6.5 MediumApril 16, 2025
• themefic tourfic WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability CVE-2025-24650 9.1 CriticalJanuary 24, 2025
• themefic ultimate addons for contact form 7 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability CVE-2023-47693 7.5 HighJanuary 2, 2025
• Show olderLoading…