Themefic

Records60All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high24CVSS 7.0–8.9

Exploited now

Themefic records in CISA KEV

No Themefic vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ultimate Addons For Contact Form 7 10 records MEDIUM Tourfic 6 records MEDIUM Instantio 1 record LOW Ultimate Before After Image Slider & Gallery 1 record MEDIUM

Records

6 records in Tourfic · all components

TI-2024-19308 CVE-2024-29135 · GHSA-8mfc-4wp8-57rx

WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00663 Published 2024-03-19 No fix listed CWE-434

TI-2025-18367 CVE-2025-24650 · GHSA-p93h-x2hj-qcf8

WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00657 Published 2025-01-24 No fix listed CWE-434

TI-2024-19309 CVE-2024-29136 · GHSA-fj65-x2p9-c7vx

WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability

MEDIUM 41

Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00626 Published 2024-03-19 No fix listed CWE-502

TI-2024-19310 CVE-2024-29137 · GHSA-2qrg-pqh4-8gj9

WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00617 Published 2024-03-19 No fix listed CWE-79

TI-2024-19307 CVE-2024-29134 · GHSA-857q-p34f-mcc7

WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0034 Published 2024-03-19 No fix listed CWE-79

TI-2024-11163 CVE-2024-12032 · GHSA-rmc4-3j8x-2r79

SQL injection in Themefic Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress…

LOW 29

The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiry_id' parameter of the 'tf_enquiry_reply_…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00531 Published 2024-12-25 No fix listed CWE-89

Open these records in search →