Vulnerabilities in themefic

51 results
Vexday analysis

Themefic apresenta 12 vulnerabilidades catalogadas sem exploração ativa documentada, com apenas 2 divulgações recentes nos últimos 90 dias indicando ritmo controlado de descobertas. A ausência de vulnerabilidades críticas e de ataques em curso reduz a urgência imediata, mas a fraqueza dominante em controle de autorização (CWE-639) merece revisão da postura de acesso nos componentes afetados.

CVE-2026-56064HIGHWordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-14356MEDIUMUltra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDFEPSS 0.4%CVE-2026-27999MEDIUMWordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57395MEDIUMWordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-29134MEDIUMWordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57392MEDIUMWordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-39571MEDIUMWordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-12788MEDIUMHydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment BypassEPSS 0.3%CVE-2025-68027HIGHWordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2025-49323HIGHWordPress Hydra Booking plugin <= 1.1.10 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-39585MEDIUMWordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-39543MEDIUMWordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-68055HIGHWordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-42675HIGHWordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-28188HIGHWordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-12787MEDIUMHydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash GenerationEPSS 0.3%CVE-2026-39594MEDIUMWordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-6212HIGHUltra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database moduleEPSS 0.3%CVE-2026-12801MEDIUMUltra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider AttributesEPSS 0.3%CVE-2026-65439HIGHWordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%