Villatheme
55 CVEs across 41 Villatheme products. Browse Villatheme vulnerabilities, severities, and proof-of-concept exploits.
Villatheme products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81786 | High | 7.5 | 2026-09-10 | Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions. |
CVE-2026-81282 | Medium | 6.5 | 2026-09-03 | Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. |
CVE-2026-82227 | High | 8.5 | 2026-08-28 | Contributor SQL Injection in WPBulky <= 1.2.2 versions. |
CVE-2026-81277 | High | 8.5 | 2026-08-27 | Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. |
CVE-2026-57698 | Medium | 6.5 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows… |
CVE-2026-57422 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo… |
CVE-2026-11778 | Medium | 5.4 | 2026-07-03 | The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all version… |
CVE-2026-57352 | Medium | 4.8 | 2026-07-02 | Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions. |
CVE-2026-57664 | Medium | 4.3 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions. |
CVE-2026-57324 | Medium | 6.5 | 2026-06-26 | Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions. |
CVE-2026-54809 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue… |
CVE-2026-39593 | Medium | 6.5 | 2026-05-21 | Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: fro… |
CVE-2026-40737 | Medium | 5.3 | 2026-04-15 | Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access C… |
CVE-2026-32526 | High | 7.1 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-ab… |
CVE-2026-28132 | Medium | 5.3 | 2026-02-26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews a… |
CVE-2025-67977 | High | 8.2 | 2026-02-20 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-27052 | High | 7.5 | 2026-02-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for W… |
CVE-2026-2019 | High | 7.2 | 2026-02-18 | The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insuffici… |
CVE-2025-14541 | High | 7.2 | 2026-02-11 | The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags para… |
CVE-2025-14509 | High | 7.2 | 2025-12-30 | The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is du… |
CVE-2025-68556 | Medium | 5.3 | 2025-12-23 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-68550 | High | 7.6 | 2025-12-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky wpbulky-wp-bulk-edit-post-types allows… |
CVE-2025-14581 | Medium | 4.3 | 2025-12-13 | The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_rep… |
CVE-2025-66528 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configu… |
CVE-2025-49372 | Critical | 10.0 | 2025-11-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Remote Code Inclusion.T… |
CVE-2025-64200 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce emai… |
CVE-2025-47570 | High | 7.1 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-re… |
CVE-2025-53571 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-30993 | Medium | 6.5 | 2025-08-14 | Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configu… |
CVE-2025-47563 | Medium | 5.3 | 2025-05-16 | Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2024-13320 | High | 7.5 | 2025-03-07 | The CURCY - WooCommerce Multi Currency - Currency Switcher plugin for WordPress is vulnerable to SQL Injection via the 'wc_filter_price_meta[where]' parameter… |
CVE-2024-13487 | High | 7.3 | 2025-02-06 | The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to… |
CVE-2024-12861 | Medium | 6.5 | 2025-01-30 | The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_v… |
CVE-2025-22803 | Medium | 6.5 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce w… |
CVE-2022-46796 | Medium | 6.5 | 2024-12-13 | Missing Authorization vulnerability in VillaTheme CURCY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from… |
CVE-2024-49288 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce emai… |
CVE-2024-49283 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows Reflected XSS… |
CVE-2024-8277 | Critical | 9.8 | 2024-09-11 | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due t… |
CVE-2024-4039 | Medium | 6.5 | 2024-05-14 | The The Orders Tracking for WooCommerce plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-1687 | Medium | 5.4 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing… |
CVE-2024-1686 | Medium | 4.3 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and in… |
CVE-2023-50831 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY – Multi Currency for WooCommerce allows… |
CVE-2023-48778 | Medium | 5.4 | 2023-12-18 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/… |
CVE-2023-4216 | Low | 2.7 | 2023-09-04 | The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege us… |
CVE-2023-30482 | Medium | 6.5 | 2023-08-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in VillaTheme WPBulky plugin <= 1.0.10 versions. |
CVE-2021-4395 | Medium | 4.3 | 2023-07-01 | The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is d… |
CVE-2021-4379 | Medium | 6.5 | 2023-06-07 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_fixed_price functio… |
CVE-2021-4376 | Medium | 4.3 | 2023-06-07 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible fo… |
CVE-2022-46810 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions. |
CVE-2022-46812 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions. |
CVE-2022-46806 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification. |
CVE-2022-44634 | Medium | 4.9 | 2022-11-18 | Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress. |
CVE-2022-41623 | High | 7.5 | 2022-10-14 | Sensitive Data Exposure in Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 on WordPress. |
CVE-2022-1037 | High | 7.2 | 2022-04-18 | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local U… |
CVE-2021-25062 | Medium | 6.1 | 2022-01-24 | The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leadin… |