Skip to content
OpenAdvisories

Vendor

themefic

58 known vulnerabilities.

Products

Ultimate Addons for Contact Form 7 10 Tourfic 10 Hydra Booking 9 Ultra Addons for Contact Form 7 9 Hydra Booking — Appointment Scheduling & Booking Calendar 4 Instantio 3 Travelfic Toolkit 3 Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin 3 Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental 2 BEAF 2 Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin 1 Ultra Addons for WPForms 1 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-82901 Public exploit

    Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

    The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for una…

    themefic Ultra Addons for Contact Form 7 Web / CMS
  • High 8.5
    CVE-2025-68055 Public exploit

    WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.

    themefic Hydra Booking
  • High 7.2
    CVE-2025-6220 Public exploit

    Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

    The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attacker…

    themefic Ultra Addons for Contact Form 7 Web / CMS
  • Medium 6.6
    CVE-2025-47550 Public exploit

    WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Instantio: from n/a through <= 3.3.16.

    themefic Instantio
  • Critical 9.1
    CVE-2025-47549 Public exploit

    WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.

    themefic BEAF