Skip to content
OpenAdvisories

Vendor

themefic

58 known vulnerabilities.

Products

Ultimate Addons for Contact Form 7 10 Tourfic 10 Hydra Booking 9 Ultra Addons for Contact Form 7 9 Hydra Booking — Appointment Scheduling & Booking Calendar 4 Instantio 3 Travelfic Toolkit 3 Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin 3 Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental 2 BEAF 2 Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin 1 Ultra Addons for WPForms 1 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings 1
All Critical High Medium Low Exploited only Public exploit

58 results · Feed

  • High 8.5
    CVE-2025-49323

    WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.

    themefic Hydra Booking
  • Medium 6.6
    CVE-2025-47550 Public exploit

    WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Instantio: from n/a through <= 3.3.16.

    themefic Instantio
  • Critical 9.1
    CVE-2025-47549 Public exploit

    WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.

    themefic BEAF
  • Medium 6.5
    CVE-2025-24581

    WordPress Instantio plugin <= 3.3.7 - Settings Change vulnerability

    Missing Authorization vulnerability in Themefic Instantio instantio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instantio: from n/a through <= 3.3.7.

    themefic Instantio
  • Medium 6.5
    CVE-2025-39585

    WordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Stored XSS.This issue affects Travelfic Toolkit: from n/a through <= 1.2.1.

    themefic Travelfic Toolkit
  • Critical 9.1
    CVE-2025-24650

    WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.

    themefic Tourfic
  • High 7.5
    CVE-2023-47693

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a throu…

    themefic Ultimate Addons for Contact Form 7
  • Medium 6.5
    CVE-2024-12032

    Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection

    The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiry_id' parameter of the 'tf_enquiry_reply_email_callback' function in all version…

    themefic Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin Web / CMS
  • Medium 4.3
    CVE-2024-8319

    Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions

    The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf…

    themefic Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin Web / CMS
  • Medium 4.3
    CVE-2024-32433

    WordPress BEAF plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Themefic BEAF beaf-before-and-after-gallery.This issue affects BEAF: from n/a through <= 4.5.4.

    themefic BEAF
  • Medium 6.5
    CVE-2024-29134

    WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.

    themefic Tourfic
  • Critical 9.9
    CVE-2024-29135

    WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.

    themefic Tourfic
  • High 8.5
    CVE-2024-29136

    WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.

    themefic Tourfic
  • High 7.1
    CVE-2024-29137 Scanner template

    WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.

    themefic Tourfic
  • High 8.5
    CVE-2023-30495

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.

    themefic Ultimate Addons for Contact Form 7
  • High 7.1
    CVE-2023-49766

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.2.0.

    themefic Ultimate Addons for Contact Form 7
  • High 7.1
    CVE-2023-30493

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions.

    themefic Ultimate Addons for Contact Form 7
  • High 8.2
    CVE-2022-47586

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

    Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions.

    themefic Ultimate Addons for Contact Form 7