Themefic Vulnerabilities and Affected Products

Products

Tourfic10 vulnerabilities
Hydra Booking9 vulnerabilities
Ultimate Addons for Contact Form 78 vulnerabilities
Ultra Addons for Contact Form 75 vulnerabilities
Hydra Booking — Appointment Scheduling & Booking Calendar3 vulnerabilities
Instantio3 vulnerabilities
Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin3 vulnerabilities
Travelfic Toolkit3 vulnerabilities
BEAF2 vulnerabilities
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings1 vulnerability
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin1 vulnerability
Ultra Addons for WPForms1 vulnerability

Themefic vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-27999MEDIUM	WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. CWE-862Aug 13, 2026	CVSS6.5v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-57395MEDIUM	WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5. CWE-862Jul 13, 2026	CVSS6.5v3.1	EPSS0.248%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-57392MEDIUM	WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5. CWE-862Jul 13, 2026	CVSS6.5v3.1	EPSS0.242%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-56064HIGH	WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability Subscriber SQL Injection in Tourfic <= 2.22.5 versions. CWE-89Jun 26, 2026	CVSS8.5v3.1	EPSS0.27%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-39543MEDIUM	WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4. CWE-862Apr 8, 2026	CVSS5.3v3.1	EPSS0.221%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-24650CRITICAL	WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3. CWE-434Jan 24, 2025	CVSS9.1v3.1	EPSS0.626%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-29134MEDIUM	WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8. CWE-79Mar 19, 2024	CVSS6.5v3.1	EPSS0.343%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-29135CRITICAL	WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15. CWE-434Mar 19, 2024	CVSS9.9v3.1	EPSS0.669%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-29136HIGH	WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17. CWE-502Mar 19, 2024	CVSS8.5v3.1	EPSS0.632%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-29137HIGH	WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7. CWE-79Mar 19, 20241 related artifact	CVSS7.1v3.1	EPSS0.622%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX