Skip to content
OpenAdvisories

Vendor

ThemeHigh

18 known vulnerabilities.

Products

Checkout Field Editor for WooCommerce (Pro) 3 Payment Gateway of Stripe for WooCommerce 3 Advanced FAQ Manager 2 Checkout Field Editor (Checkout Manager) for WooCommerce 2 Job Manager & Career – Manage job board listings, and recruitments 1 WooCommerce Extra Product Options Pro 1 Extra Product Options For WooCommerce | Custom Product Addons and Fields 1 Stripe Payment Gateway for WooCommerce 1 Dynamic Pricing and Discount Rules 1 Email Customizer for WooCommerce (Pro) 1 Email Customizer for WooCommerce 1 Email Customizer for WooCommerce | Drag and Drop Email Templates Builder 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-104926

    WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter

    The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and outpu…

    ThemeHigh WooCommerce Extra Product Options Pro Web / CMS
  • Medium 5.3
    CVE-2026-9832

    Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

    The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoi…

    ThemeHigh Payment Gateway of Stripe for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-14955

    Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter

    The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-l…

    ThemeHigh Checkout Field Editor for WooCommerce (Pro) Web / CMS
  • Medium 6.5
    CVE-2026-45217

    WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitation. This issue affects Stripe Payment Gateway for WooCommerce: from n/a through 5.0.7.

    ThemeHigh Stripe Payment Gateway for WooCommerce Web / CMS
  • Medium 4.4
    CVE-2025-13974

    Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content

    The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible fo…

    ThemeHigh Email Customizer for WooCommerce | Drag and Drop Email Templates Builder Web / CMS
  • Medium 5.9
    CVE-2025-67556

    WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows Stored XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

    ThemeHigh Advanced FAQ Manager
  • Medium 6.5
    CVE-2025-67553

    WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows DOM-Based XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

    ThemeHigh Advanced FAQ Manager
  • Medium 4.3
    CVE-2025-49077

    WordPress Dynamic Pricing and Discount Rules plugin <= 2.2.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeHigh Dynamic Pricing and Discount Rules discount-and-dynamic-pricing allows Cross Site Request Forgery.This issue affects Dynamic Pricing and Discount Rules: from n/a through <= 2.2.9.

    ThemeHigh Dynamic Pricing and Discount Rules
  • Medium 4.7
    CVE-2024-8499

    Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice

    The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitizatio…

    ThemeHigh Checkout Field Editor (Checkout Manager) for WooCommerce Web / CMS