Login Request a demo
TH
Vendor
themefic
14 products with CVEs on record
63
CVEs
0
On KEV
4
New 30D
Products
UA
Ultimate Addons for Contact Form 7
Themefic
9.8
16 CVEs0 on KEV1 new
UA
Ultra Addons for Contact Form 7
themefic
9.8
7 CVEs0 on KEV1 new
TA
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
themefic
6.4
2 CVEs0 on KEV2 new
TO
Tourfic
themefic
9.1
11 CVEs0 on KEV0 new
HB
Hydra Booking
themefic
8.5
9 CVEs0 on KEV0 new
HB
Hydra Booking — Appointment Scheduling & Booking Calendar
themefic
6.4
4 CVEs0 on KEV0 new
IN
Instantio
Themefic
7.2
3 CVEs0 on KEV0 new
TT
Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin
themefic
6.5
3 CVEs0 on KEV0 new
TT
Travelfic Toolkit
themefic
8.1
3 CVEs0 on KEV0 new
BE
BEAF
Themefic
7.2
1 CVEs0 on KEV0 new
HB
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings
themefic
8.8
1 CVEs0 on KEV0 new
TA
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin
themefic
7.5
1 CVEs0 on KEV0 new
UB
Ultimate Before After Image Slider & Gallery
Themefic
7.2
1 CVEs0 on KEV0 new
UA
Ultra Addons for WPForms
Themefic
6.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-97470
TA
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
themefic
6.4
0%
Oct 16Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
CVE-2026-103480
TA
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
themefic
6.4
0%
Oct 16Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
CVE-2026-103999
UA
Ultra Addons for Contact Form 7
themefic
7.2
0%
Oct 16Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
CVE-2026-96833
UA
Ultimate Addons for Contact Form 7
Themefic
7.2
0%
Sep 30WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
CVE-2026-82901
UA
Ultra Addons for Contact Form 7
themefic
9.8
4%
Sep 26Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
CVE-2026-95586
UA
Ultimate Addons for Contact Form 7
Themefic
6.5
0%
Sep 23WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability
CVE-2026-15948
HB
Hydra Booking — Appointment Scheduling & Booking Calendar
themefic
6.4
0%
Aug 15Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
CVE-2026-28188
HB
Hydra Booking
themefic
7.3
0%
Aug 13WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability
CVE-2026-28186
TT
Travelfic Toolkit
themefic
8.1
0%
Aug 13WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability
CVE-2026-27999
TO
Tourfic
themefic
6.5
0%
Aug 13WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability
CVE-2026-12801
UA
Ultra Addons for Contact Form 7
themefic
6.4
0%
Aug 7Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
CVE-2026-65439
UA
Ultimate Addons for Contact Form 7
Themefic
7.1
0%
Jul 27WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability
CVE-2026-57395
TO
Tourfic
Themefic
6.5
0%
Jul 13WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability
CVE-2026-57392
TO
Tourfic
Themefic
6.5
0%
Jul 13WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability
CVE-2026-57388
HB
Hydra Booking
Themefic
7.1
0%
Jul 13WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability
CVE-2026-12433
HB
Hydra Booking — Appointment Scheduling & Booking Calendar
themefic
4.3
0%
Jul 9Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
CVE-2026-56064
TO
Tourfic
Themefic
8.5
0%
Jun 26WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability
CVE-2026-12937
TA
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin
themefic
7.5
1%
Jun 25Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter
CVE-2026-39594
UA
Ultra Addons for WPForms
Themefic
6.4
0%
Jun 15WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability
CVE-2026-42675
HB
Hydra Booking
Themefic
7.3
0%
Jun 1WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability
CVE-2026-39571
IN
Instantio
Themefic
5.3
0%
Apr 8WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability
CVE-2026-39543
TO
Tourfic
Themefic
5.3
0%
Apr 8WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability
CVE-2026-39541
HB
Hydra Booking
Themefic
5.9
0%
Apr 8WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability
CVE-2026-32460
UA
Ultimate Addons for Contact Form 7
Themefic
6.5
0%
Mar 13WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability
CVE-2026-24945
UA
Ultimate Addons for Contact Form 7
Themefic
5.3
0%
Feb 3WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability
CVE-2026-24940
TT
Travelfic Toolkit
Themefic
4.3
0%
Feb 3WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability
CVE-2025-68027
HB
Hydra Booking
Themefic
7.3
0%
Jan 22WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability
CVE-2025-68055
HB
Hydra Booking
Themefic
8.5
0%
Dec 16WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability
CVE-2025-14356
UA
Ultra Addons for Contact Form 7
themefic
4.3
0%
Dec 12Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF
CVE-2025-12788
HB
Hydra Booking — Appointment Scheduling & Booking Calendar
themefic
5.3
0%
Nov 11Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
CVE-2025-12787
HB
Hydra Booking — Appointment Scheduling & Booking Calendar
themefic
5.3
0%
Nov 11Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
CVE-2025-49378
HB
Hydra Booking
Themefic
8.5
0%
Oct 22WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerability
CVE-2025-49377
HB
Hydra Booking
Themefic
6.3
0%
Oct 22WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerability
CVE-2024-8860
TT
Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin
themefic
4.3
0%
Aug 26Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions
CVE-2025-7689
HB
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings
themefic
8.8
0%
Jul 29Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
CVE-2025-6756
UA
Ultra Addons for Contact Form 7
themefic
5.4
0%
Jul 1Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode
CVE-2025-6212
UA
Ultra Addons for Contact Form 7
themefic
6.1
0%
Jun 26Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module
CVE-2025-6220
UA
Ultra Addons for Contact Form 7
themefic
7.2
1%
Jun 18Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
CVE-2025-49323
HB
Hydra Booking
Themefic
8.5
0%
Jun 6WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection Vulnerability
CVE-2025-47550
IN
Instantio
Themefic
7.2
0%
May 7WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability
CVE-2025-47549
BE
BEAF
Themefic
7.2
1%
May 7WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability
CVE-2025-24581
IN
Instantio
Themefic
6.5
0%
Apr 17WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerability
CVE-2025-39585
TT
Travelfic Toolkit
Themefic
6.5
0%
Apr 16WordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability
CVE-2025-24650
TO
Tourfic
Themefic
9.1
1%
Jan 24WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability
CVE-2023-47693
UA
Ultimate Addons for Contact Form 7
Themefic
7.5
1%
Jan 2WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability
CVE-2024-12032
TT
Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin
themefic
6.5
1%
Dec 25Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection
CVE-2024-8319
TT
Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin
themefic
4.3
0%
Aug 30Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions
CVE-2024-29137
TO
Tourfic
Themefic
6.1
1%
Mar 19Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <=…
CVE-2024-29136
TO
Tourfic
Themefic
8.8
1%
Mar 19Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17
CVE-2024-29135
TO
Tourfic
Themefic
8.8
1%
Mar 19Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15
CVE-2024-29134
TO
Tourfic
Themefic
5.4
0%
Mar 19Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <=…
CVE-2023-30495
UA
Ultimate Addons For Contact Form 7
Themefic
8.1
1%
Dec 20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate…
CVE-2023-49766
UA
Ultimate Addons For Contact Form 7
Themefic
6.1
0%
Dec 14Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.This issue…
CVE-2023-30493
UA
Ultimate Addons For Contact Form 7
Themefic
6.1
0%
Sep 27Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions
CVE-2023-2803
UA
Ultimate Addons For Contact Form 7
Themefic
6.1
0%
Aug 14The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected…
CVE-2023-2802
UA
Ultimate Addons For Contact Form 7
Themefic
4.8
0%
Aug 14The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
CVE-2022-47586
UA
Ultimate Addons For Contact Form 7
Themefic
9.8
1%
Jun 19Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions
CVE-2023-1615
UA
Ultimate Addons For Contact Form 7
Themefic
6.5
1%
Jun 9The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23