CVE-2023-49766

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.2.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Ultimate Addons For Contact Form 7

CVE-2023-30495

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Ultimate Addons For Contact Form 7

CVE-2025-49378

WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Hydra Booking Wordpress

CVE-2025-68055

WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Hydra Booking Wordpress

CVE-2026-39541

WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Hydra Booking Wordpress

CVE-2026-39543

WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Tourfic Wordpress

CVE-2026-39571

WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This issue affects Instantio: from n/a through <= 3.3.30.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Instantio Wordpress

CVE-2025-49377

WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Hydra Booking Wordpress

CVE-2025-47550

WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Instantio: from n/a through <= 3.3.16.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Instantio

CVE-2025-47549

WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Ultimate Before After Image Slider \& Gallery

CVE-2025-24650

WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Tourfic

CVE-2024-29137

WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Tourfic

CVE-2024-29136

WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Tourfic

CVE-2024-29134

WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Tourfic

CVE-2026-32460

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.36.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Ultimate Addons For Contact Form 7 Wordpress

CVE-2025-12787

Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhb_meeting_form_submit_callback" function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Hydra Booking Wordpress

CVE-2025-12788

Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Hydra Booking Wordpress

CVE-2025-14356

Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_generated_pdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate and get form submission PDF, when the "PDF Generator" and the "Database" addons are enabled (disabled by default).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Ultimate Addons For Contact Form 7 Wordpress

CVE-2026-24945

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.34.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Ultimate Addons For Contact Form 7 Wordpress

CVE-2025-7689

Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function

The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Hydra Booking Wordpress