Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Themefic Component: Tourfic Clear all filters
TI-2025-18367 CVE-2025-24650 · GHSA-p93h-x2hj-qcf8

WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

Priority MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00657 Published 2025-01-24 No fix listed CWE-434
TI-2024-11163 CVE-2024-12032 · GHSA-rmc4-3j8x-2r79

SQL injection in Themefic Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress…

Priority LOW 29

The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiry_id' parameter of the 'tf_enquiry_reply_…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00531 Published 2024-12-25 No fix listed CWE-89
TI-2024-19307 CVE-2024-29134 · GHSA-857q-p34f-mcc7

WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0034 Published 2024-03-19 No fix listed CWE-79