Villatheme vulnerabilities

Products

• Curcy 8
• Happy 5
• Photo Reviews For Woocommerce 5
• Thank You Page Customizer For Woocommerce 4
• Thank You Page Customizer For Woocommerce – Increase Your Sales 4
• Woocommerce Thank You Page Customizer 4
• Abandoned Cart Recovery For Woocommerce 3
• Bopo – Woocommerce Product Bundle Builder 3
• Curcy – Multi Currency For Woocommerce – Smoothly On Woocommerce 9.x 3
• Email Template Customizer For Woocommerce 3
• Gift4u 3
• Orders Tracking For Woocommerce 3
• Wpbulky 3
• Affi – Affiliate Marketing For Woocommerce 2
• Ald – Dropshipping And Fulfillment For Aliexpress And Woocommerce 2
• Buildkit – Product Builder For Woocommerce – Custom Pc Builder 2
• Cart All In One For Woocommerce 2
• Curcy - Woocommerce Multi Currency - Currency Switcher 2
• Salevo 2
• Woocommerce Photo Reviews 2

Newest

• villatheme curcy WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability CVE-2026-121775 5.3 MediumNovember 7, 2026
• villatheme curcy WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability CVE-2026-122663 5.3 MediumNovember 7, 2026
• villatheme revopic – photo reviews for woocommerce Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter CVE-2026-110251 5.4 MediumOctober 31, 2026
• villatheme handmade – dropshipping for etsy and woocommerce WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability CVE-2026-112827 7.1 HighOctober 29, 2026
• villatheme photo reviews for woocommerce WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability CVE-2026-111404 3.7 LowOctober 26, 2026
• villatheme customer coupons for woocommerce WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability CVE-2026-112839 4.3 MediumOctober 26, 2026
• villatheme bopo – woocommerce product bundle builder WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability CVE-2026-110377 5.3 MediumOctober 26, 2026
• andy ha depart WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability CVE-2026-110376 4.3 MediumOctober 26, 2026
• villatheme salevo WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability CVE-2026-103081 7.5 HighOctober 14, 2026
• villatheme email template customizer for woocommerce WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability CVE-2026-103358 7.5 HighOctober 14, 2026
• villatheme salevo WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability CVE-2026-103080 5.3 MediumOctober 12, 2026
• villatheme tmds WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability CVE-2026-103356 5.4 MediumOctober 12, 2026
• villatheme ald – dropshipping and fulfillment for aliexpress and woocommerce WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability CVE-2026-103685 4.3 MediumOctober 10, 2026
• villatheme affi – affiliate marketing for woocommerce WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability CVE-2026-104398 9.8 CriticalOctober 10, 2026
• villatheme gift4u WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability CVE-2026-103357 6.9 MediumOctober 10, 2026
• villatheme thank you page customizer for woocommerce WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability CVE-2026-103071 7.5 HighOctober 10, 2026
• villatheme photo reviews for woocommerce Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter CVE-2026-100161 7.2 HighOctober 10, 2026
• villatheme core WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability CVE-2026-103072 4.3 MediumOctober 8, 2026
• villatheme buildkit – product builder for woocommerce – custom pc builder WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability CVE-2026-97275 5.3 MediumOctober 5, 2026
• villatheme lookzy WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability CVE-2026-102383 6.5 MediumOctober 5, 2026
• villatheme photo reviews for woocommerce WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability CVE-2026-100515 7.1 HighOctober 5, 2026
• villatheme curcy WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability CVE-2026-97071 5.3 MediumOctober 5, 2026
• villatheme photo reviews for woocommerce Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter CVE-2026-101923 8.1 HighOctober 3, 2026
• villatheme photo reviews for woocommerce WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-100517 7.5 HighOctober 1, 2026
• villatheme buildkit – product builder for woocommerce – custom pc builder WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability CVE-2026-102379 8.5 HighOctober 1, 2026
• villatheme affi – affiliate marketing for woocommerce WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability CVE-2026-102390 5.3 MediumOctober 1, 2026
• villatheme curcy WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability CVE-2026-94171 7.1 HighSeptember 30, 2026
• villatheme notivo WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability CVE-2026-97261 5.3 MediumSeptember 30, 2026
• villatheme thank you page customizer for woocommerce WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability CVE-2026-81786 7.5 HighSeptember 10, 2026
• villatheme product variations swatches for woocommerce WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability CVE-2026-81282 6.5 MediumSeptember 3, 2026
• villatheme wpbulky WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability CVE-2026-82227 8.5 HighAugust 28, 2026
• villatheme suggestion engine for woocommerce WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability CVE-2026-81277 8.5 HighAugust 27, 2026
• villatheme abandoned cart recovery for woocommerce WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability CVE-2026-57698 6.5 MediumJuly 13, 2026
• villatheme bopo – woocommerce product bundle builder WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57422 7.1 HighJuly 13, 2026
• villatheme curcy – multi currency for woocommerce – smoothly on woocommerce 9.x CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter CVE-2026-11778 5.4 MediumJuly 3, 2026
• villatheme ald – dropshipping and fulfillment for aliexpress and woocommerce WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability CVE-2026-57352 4.8 MediumJuly 2, 2026
• villatheme bopo – woocommerce product bundle builder WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerability CVE-2026-57664 4.3 MediumJune 26, 2026
• villatheme gift4u WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability CVE-2026-57324 6.5 MediumJune 26, 2026
• villatheme gift4u WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability CVE-2026-54809 9.3 CriticalJune 17, 2026
• villatheme happy WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability CVE-2026-39593 6.5 MediumMay 21, 2026
• villatheme compe WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-40737 5.3 MediumApril 15, 2026
• villatheme abandoned cart recovery for woocommerce WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability CVE-2026-32526 7.1 HighMarch 25, 2026
• villatheme woocommerce photo reviews WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability CVE-2026-28132 5.3 MediumFebruary 26, 2026
• villatheme happy WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability CVE-2025-67977 8.2 HighFebruary 20, 2026
• villatheme sales countdown timer for woocommerce and wordpress WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability CVE-2026-27052 7.5 HighFebruary 19, 2026
• villatheme cart all in one for woocommerce Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting CVE-2026-2019 7.2 HighFebruary 18, 2026
• villatheme lucky wheel giveaway Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter CVE-2025-14541 7.2 HighFebruary 11, 2026
• villatheme lucky wheel for woocommerce – spin a sale Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags CVE-2025-14509 7.2 HighDecember 30, 2025
• villatheme wpbulky WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability CVE-2025-68550 7.6 HighDecember 23, 2025
• villatheme happy WordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability CVE-2025-68556 5.3 MediumDecember 23, 2025
• Show olderLoading…