Skip to content
Noroxi

Themefic records

18 published records for vendor themefic.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
61.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 23
  2. 24
  3. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

18 records
  • CVE-2022-47586
    39Monitor

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

    CriticalCVSS 9.8No exploitEPSS 1%

    themefic · ultimate addons for contact form 7Jun 19, 2023

  • CVE-2025-24650
    36Monitor

    WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.1No exploitEPSS 1%

    themefic · tourficJan 24, 2025

  • CVE-2024-29135
    35Monitor

    WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    themefic · tourficMar 19, 2024

  • CVE-2024-29136
    35Monitor

    WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    themefic · tourficMar 19, 2024

  • CVE-2023-30495
    32Monitor

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

    HighCVSS 8.1No exploitEPSS 1%

    themefic · ultimate addons for contact form 7Dec 20, 2023

  • CVE-2025-6220
    28Monitor

    Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

    HighCVSS 7.2Proof of conceptEPSS 1%

    themefic · ultimate addons for contact form 7Jun 18, 2025

  • CVE-2025-47549
    28Monitor

    WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

    HighCVSS 7.2Proof of conceptEPSS 1%

    themefic · ultimate before after image slider \& galleryMay 7, 2025

  • CVE-2025-47550
    28Monitor

    WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability

    HighCVSS 7.2Proof of conceptEPSS 0%

    themefic · instantioMay 7, 2025

  • CVE-2023-1615
    26Monitor

    The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and inc

    MediumCVSS 6.5No exploitEPSS 1%

    themefic · ultimate addons for contact form 7Jun 9, 2023

  • CVE-2024-12032
    26Monitor

    Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injectio

    MediumCVSS 6.5No exploitEPSS 1%

    themefic · tourficDec 25, 2024

  • CVE-2024-29137
    24Monitor

    WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 1%

    themefic · tourficMar 19, 2024

  • CVE-2023-2803
    24Monitor

    Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS

    MediumCVSS 6.1No exploitEPSS 0%

    themefic · ultimate addons for contact form 7Aug 14, 2023

  • CVE-2023-49766
    24Monitor

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1No exploitEPSS 0%

    themefic · ultimate addons for contact form 7Dec 14, 2023

  • CVE-2023-30493
    24Monitor

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1No exploitEPSS 0%

    themefic · ultimate addons for contact form 7Sep 27, 2023

  • CVE-2025-6212
    24Monitor

    Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module

    MediumCVSS 6.1No exploitEPSS 0%

    themefic · ultimate addons for contact form 7Jun 26, 2025

  • CVE-2024-29134
    21Monitor

    WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    themefic · tourficMar 19, 2024

  • CVE-2025-6756
    21Monitor

    Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode

    MediumCVSS 5.4No exploitEPSS 0%

    themefic · ultimate addons for contact form 7Jul 1, 2025

  • CVE-2023-2802
    19Monitor

    Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSS

    MediumCVSS 4.8No exploitEPSS 0%

    themefic · ultimate addons for contact form 7Aug 14, 2023