Themefic has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 3. The median CVSS is 6.8 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-79 (4). Most affected products: Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental (2), Ultra Addons for Contact Form 7 (2), ultimate-addons-for-contact-form-7 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental 2
- Ultra Addons for Contact Form 7 2
- ultimate-addons-for-contact-form-7 2
Worst active — by depth score
CVE-2026-82901Critical· 9.8The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.5067CVE-2026-103999High· 7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping40CVE-2026-96833High· 7.2Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.40CVE-2026-95586Medium· 6.5Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.36CVE-2026-97470Medium· 6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.…35
Themefic vulnerabilities
CVEs affecting Themefic, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-97470Medium· 6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.…
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.…
CVE-2026-103999High· 7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it …
CVE-2026-103480Medium· 6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitiza…
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitiza…
CVE-2026-96833High· 7.2Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
CVE-2026-82901Critical· 9.8PoCThe Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This mak…
CVE-2026-95586Medium· 6.5Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.