Themefic vulnerabilities

CVEs per yearBy the year they were published

1. 20234
2. 20247
3. 202518
4. 202628

Newest CVEs

• CVE-2026-102435

  Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

  themefic · Ultra Addons for Contact Form 7

  Critical9.8
• CVE-2026-97470

  Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role

  themefic · Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental

  Medium6.4
• CVE-2026-103480

  Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

  themefic · Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental

  Medium6.4
• CVE-2026-103999

  Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

  themefic · Ultra Addons for Contact Form 7

  High7.2
• CVE-2026-96833

  WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

  Themefic · Ultimate Addons for Contact Form 7

  High7.2
• CVE-2026-82901

  Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

  themefic · Ultra Addons for Contact Form 7

  Critical9.8
• CVE-2026-95586

  WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

  Themefic · Ultimate Addons for Contact Form 7

  Medium6.5
• CVE-2026-15948

  Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter

  themefic · Hydra Booking — Appointment Scheduling & Booking Calendar

  Medium6.4
• CVE-2026-28188

  WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

  themefic · Hydra Booking

  High7.3
• CVE-2026-28186

  WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

  themefic · Travelfic Toolkit

  High8.1