Themefic Tourfic vulnerabilities

• themefic tourfic – ai powered travel booking, hotel booking & car rental Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role CVE-2026-97470 6.4 MediumOctober 16, 2026
• themefic tourfic – ai powered travel booking, hotel booking & car rental Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute CVE-2026-103480 6.4 MediumOctober 16, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability CVE-2026-27999 6.5 MediumAugust 13, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability CVE-2026-57395 6.5 MediumJuly 13, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability CVE-2026-57392 6.5 MediumJuly 13, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability CVE-2026-56064 8.5 HighJune 26, 2026
• themefic tourfic – ai powered travel booking, hotel booking & car rental wordpress plugin Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter CVE-2026-12937 7.5 HighJune 25, 2026
• themefic tourfic WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability CVE-2026-39543 5.3 MediumApril 8, 2026
• themefic tourfic – travel booking, hotel booking & car rental wordpress plugin Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions CVE-2024-8860 4.3 MediumAugust 26, 2025
• themefic tourfic WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability CVE-2025-24650 9.1 CriticalJanuary 24, 2025
• themefic tourfic, tourfic – travel booking, hotel booking & car rental wordpress plugin +1 more Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection CVE-2024-12032 6.5 MediumDecember 25, 2024
• themeific tourfic, themefic tourfic – travel booking, hotel booking & car rental wordpress plugin +1 more Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions CVE-2024-8319 4.3 MediumAugust 30, 2024
• themefic tourfic WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-29134 6.5 MediumMarch 19, 2024
• themefic tourfic WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability CVE-2024-29135 9.9 CriticalMarch 19, 2024
• themefic tourfic WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability CVE-2024-29136 8.5 HighMarch 19, 2024
• themefic tourfic WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-29137 7.1 HighMarch 19, 2024