Log in Start free

Themefic

Products

ProductCVEsExploitedLatest
Tourfic10–Aug 13, 2026
Ultimate Addons for Contact Form 710–Sep 30, 2026
Hydra Booking9–Aug 13, 2026
Ultra Addons for Contact Form 78–Nov 2, 2026
Hydra Booking — Appointment Scheduling & Booking Calendar4–Aug 15, 2026
Instantio3–Apr 8, 2026
Travelfic Toolkit3–Aug 13, 2026
Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin3–Aug 26, 2025
BEAF2–May 7, 2025
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental2–Oct 16, 2026
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin1–Jun 25, 2026
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings1–Jul 29, 2025
Ultra Addons for WPForms1–Jun 15, 2026

Exploited and recent CVEs

  • CVE-2026-102435 Critical 9.8 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field 0.6%
  • CVE-2026-97470 Medium 6.4 Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role 0.2%
  • CVE-2026-103480 Medium 6.4 Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute 0.2%
  • CVE-2026-103999 High 7.2 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload 0.3%
  • CVE-2026-96833 High 7.2 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-82901 Critical 9.8 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field 4.3%
  • CVE-2026-95586 Medium 6.5 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-15948 Medium 6.4 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter 0.4%
  • CVE-2026-28188 High 7.3 WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-28186 High 8.1 WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability 0.4%
  • CVE-2026-27999 Medium 6.5 WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability 0.3%
  • CVE-2026-12801 Medium 6.4 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes 0.3%
  • CVE-2026-65439 High 7.1 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-57395 Medium 6.5 WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability 0.3%
  • CVE-2026-57392 Medium 6.5 WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability 0.3%
  • CVE-2026-57388 High 7.1 WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-12433 Medium 4.3 Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter 0.5%
  • CVE-2026-56064 High 8.5 WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability 0.4%
  • CVE-2026-12937 High 7.5 Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter 0.5%
  • CVE-2026-39594 Medium 6.4 WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability 0.3%
  • CVE-2026-42675 High 7.3 WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability 0.2%
  • CVE-2026-39571 Medium 5.3 WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2026-39543 Medium 5.3 WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability 0.2%
  • CVE-2026-39541 Medium 5.9 WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-32460 Medium 6.5 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-24945 Medium 5.3 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability 0.3%
  • CVE-2026-24940 Medium 4.3 WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability 0.2%
  • CVE-2025-68027 High 7.3 WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability 0.3%
  • CVE-2025-68055 High 8.5 WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability 0.3%
  • CVE-2025-14356 Medium 4.3 Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF 0.4%