ThemeHigh vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20244
3. 20253
4. 20268

Newest CVEs

• CVE-2026-104926

  WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter

  ThemeHigh · WooCommerce Extra Product Options Pro

  Medium6.1
• CVE-2026-81534

  Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter

  ThemeHigh · Email Customizer for WooCommerce (Pro)

  High8.8
• CVE-2026-102392

  WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

  ThemeHigh · Extra Product Options For WooCommerce | Custom Product Addons and Fields

  High7.2
• CVE-2026-9832

  Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

  themehigh · Payment Gateway of Stripe for WooCommerce

  Medium5.3
• CVE-2026-14955

  Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter

  Themehigh · Checkout Field Editor for WooCommerce (Pro)

  Medium6.5
• CVE-2026-45217

  WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability

  ThemeHigh · Stripe Payment Gateway for WooCommerce

  Medium6.5
• CVE-2026-3231

  Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field

  themehigh · Checkout Field Editor (Checkout Manager) for WooCommerce

  High7.2
• CVE-2025-13974

  Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content

  themehigh · Email Customizer for WooCommerce | Drag and Drop Email Templates Builder

  Medium4.4
• CVE-2025-67556

  WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

  ThemeHigh · Advanced FAQ Manager

  Medium5.9
• CVE-2025-67553

  WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

  ThemeHigh · Advanced FAQ Manager

  Medium6.5