CVEs we hold for Themefic
Records whose assigning authority named Themefic as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-65439WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerabilityThemefic Ultimate Addons for Contact Form 7
CVE-2026-57395WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerabilityThemefic Tourfic
CVE-2026-57392WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerabilityThemefic Tourfic
CVE-2026-57388WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerabilityThemefic Hydra Booking
CVE-2026-42675WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerabilityThemefic Hydra Booking
CVE-2026-39594WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerabilityThemefic Ultra Addons for WPForms
CVE-2026-39571WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerabilityThemefic Instantio
CVE-2026-39543WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerabilityThemefic Tourfic
CVE-2026-39541WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerabilityThemefic Hydra Booking
CVE-2026-32460WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerabilityThemefic Ultimate Addons for Contact Form 7
CVE-2026-28188WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerabilitythemefic Hydra Booking
CVE-2026-28186WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerabilitythemefic Travelfic Toolkit
CVE-2026-27999WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerabilitythemefic Tourfic
CVE-2026-24945WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerabilityThemefic Ultimate Addons for Contact Form 7
CVE-2026-24940WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerabilityThemefic Travelfic Toolkit
CVE-2026-15948Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameterthemefic Hydra Booking — Appointment Scheduling & Booking…
CVE-2026-12937Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameterthemefic Tourfic – AI Powered Travel Booking, Hotel Booking…
CVE-2026-12801Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider…themefic Ultra Addons for Contact Form 7
CVE-2026-12433Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via…themefic Hydra Booking — Appointment Scheduling & Booking…
CVE-2025-7689Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via…themefic Hydra Booking – All in One Appointment Booking…
CVE-2025-68055WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerabilityThemefic Hydra Booking
CVE-2025-68027WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerabilityThemefic Hydra Booking
CVE-2025-6756Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via…themefic Ultra Addons for Contact Form 7
CVE-2025-6220Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'themefic Ultra Addons for Contact Form 7
CVE-2025-6212Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database modulethemefic Ultra Addons for Contact Form 7
CVE-2025-49378WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerabilityThemefic Hydra Booking
CVE-2025-49377WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerabilityThemefic Hydra Booking
CVE-2025-49323WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection VulnerabilityThemefic Hydra Booking
CVE-2025-47550WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload VulnerabilityThemefic Instantio
CVE-2025-39585WordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityThemefic Travelfic Toolkit
CVE-2025-24650WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerabilityThemefic Tourfic
CVE-2025-14356Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form…themefic Ultra Addons for Contact Form 7
CVE-2025-12788Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings…themefic Hydra Booking — Appointment Scheduling & Booking…
CVE-2025-12787Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings…themefic Hydra Booking — Appointment Scheduling & Booking…
CVE-2024-8860Tourfic <= 2.14.5 - Missing Authorization in Multiple Functionsthemefic Tourfic – Travel Booking, Hotel Booking & Car…
CVE-2024-8319Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functionsthemefic Tourfic – Travel Booking, Hotel Booking & Car…
CVE-2024-32433WordPress BEAF plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerabilityThemefic BEAF
CVE-2024-29137WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerabilityThemefic Tourfic
CVE-2024-29136WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerabilityThemefic Tourfic
CVE-2024-29135WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerabilityThemefic Tourfic
CVE-2024-29134WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerabilityThemefic Tourfic
CVE-2024-12032Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 -…themefic Tourfic – Travel Booking, Hotel Booking & Car…
CVE-2023-49766WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)Themefic Ultimate Addons for Contact Form 7
CVE-2023-47693WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerabilityThemefic Ultimate Addons for Contact Form 7
CVE-2023-30495WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL InjectionThemefic Ultimate Addons for Contact Form 7
CVE-2023-30493WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)Themefic Ultimate Addons for Contact Form 7
CVE-2022-47586WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL InjectionThemefic Ultimate Addons for Contact Form 7
50 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.