Themefic
38 CVEs across 14 Themefic products. Browse Themefic vulnerabilities, severities, and proof-of-concept exploits.
Themefic products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15948 | Medium | 6.4 | 2026-08-15 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter… |
CVE-2026-28188 | High | 7.3 | 2026-08-13 | Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions. |
CVE-2026-28186 | High | 8.1 | 2026-08-13 | Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. |
CVE-2026-27999 | Medium | 6.5 | 2026-08-13 | Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. |
CVE-2026-12801 | Medium | 6.4 | 2026-08-07 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' at… |
CVE-2026-65439 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. |
CVE-2026-57395 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57392 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57388 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.Th… |
CVE-2026-12433 | Medium | 4.3 | 2026-07-09 | The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inc… |
CVE-2026-56064 | High | 8.5 | 2026-06-26 | Subscriber SQL Injection in Tourfic <= 2.22.5 versions. |
CVE-2026-12937 | High | 7.5 | 2026-06-25 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_… |
CVE-2026-39594 | Medium | 6.4 | 2026-06-15 | Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions. |
CVE-2026-42675 | High | 7.3 | 2026-06-01 | Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydr… |
CVE-2026-39571 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Dat… |
CVE-2026-39543 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-39541 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.Th… |
CVE-2026-32460 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addo… |
CVE-2026-24945 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured… |
CVE-2026-24940 | Medium | 4.3 | 2026-02-03 | Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-68027 | High | 7.3 | 2026-01-22 | Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a thr… |
CVE-2025-68055 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-14356 | Medium | 4.3 | 2025-12-12 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_gener… |
CVE-2025-12788 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment byp… |
CVE-2025-12787 | Medium | 5.3 | 2025-11-11 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, an… |
CVE-2025-49378 | High | 8.5 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-49377 | Medium | 6.3 | 2025-10-22 | Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2024-8860 | Medium | 4.3 | 2025-08-26 | The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_funct… |
CVE-2025-7689 | High | 8.8 | 2025-07-29 | The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function i… |
CVE-2025-6756 | Medium | 6.4 | 2025-07-01 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all ver… |
CVE-2025-6212 | High | 7.2 | 2025-06-26 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due… |
CVE-2025-6220 | High | 7.2 | 2025-06-18 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' func… |
CVE-2025-49323 | High | 8.5 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-47550 | Medium | 6.6 | 2025-05-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Inst… |
CVE-2025-47549 | Critical | 9.1 | 2025-05-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-24581 | Medium | 6.5 | 2025-04-17 | Missing Authorization vulnerability in Themefic Instantio instantio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-39585 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Store… |
CVE-2025-24650 | Critical | 9.1 | 2025-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic… |
CVE-2023-47693 | High | 7.5 | 2025-01-02 | Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured… |
CVE-2024-12032 | Medium | 6.5 | 2024-12-25 | The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injec… |
CVE-2024-8319 | Medium | 4.3 | 2024-08-30 | The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect… |
CVE-2024-32433 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Themefic BEAF beaf-before-and-after-gallery.This issue affects BEAF: from n/a through <= 4.5.4. |
CVE-2024-29137 | High | 7.1 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from… |
CVE-2024-29136 | High | 8.5 | 2024-03-19 | Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17. |
CVE-2024-29135 | Critical | 9.9 | 2024-03-19 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15. |
CVE-2024-29134 | Medium | 6.5 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from… |
CVE-2023-30495 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue af… |
CVE-2023-49766 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored… |
CVE-2023-30493 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions. |
CVE-2023-2803 | Medium | 6.1 | 2023-08-14 | The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading t… |
CVE-2023-2802 | Medium | 4.8 | 2023-08-14 | The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2022-47586 | High | 8.2 | 2023-06-19 | Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions. |
CVE-2023-1615 | High | 8.8 | 2023-06-09 | The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. Thi… |