[ Vendor · 20 CVEs ]
VillaTheme
CVEs affecting VillaTheme published in the last 30 days, plus any VillaTheme CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103081 | 14 Oct 2026 | CVSS 7.5 | VillaTheme SalevoImproper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects… | |
| CVE-2026-103358 | 14 Oct 2026 | CVSS 7.5 | VillaTheme Email Template Customizer for WooCommerceImproper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce… | |
| CVE-2026-103080 | 12 Oct 2026 | CVSS 5.3 | VillaTheme SalevoExternal Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue… | |
| CVE-2026-103356 | 12 Oct 2026 | CVSS 5.4 | VillaTheme TMDSMissing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-103685 | 10 Oct 2026 | CVSS 4.3 | VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerceMissing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting… | |
| CVE-2026-103071 | 10 Oct 2026 | CVSS 7.5 | VillaTheme Thank You Page Customizer for WooCommerceImproper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce… | |
| CVE-2026-103357 | 10 Oct 2026 | CVSS 6.9 | VillaTheme GIFT4UMissing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-104398 | 10 Oct 2026 | CVSS 9.8 | VillaTheme AFFI – Affiliate Marketing for WooCommerceDeserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows… | |
| CVE-2026-100161 | 10 Oct 2026 | CVSS 7.2 | villatheme Photo Reviews for WooCommerceThe Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id'… | |
| CVE-2026-103072 | 8 Oct 2026 | CVSS 4.3 | VillaTheme CoreMissing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-97275 | 5 Oct 2026 | CVSS 5.3 | VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC BuilderImproper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder… | |
| CVE-2026-100515 | 5 Oct 2026 | CVSS 7.1 | VillaTheme Photo Reviews for WooCommerceImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce… | |
| CVE-2026-102383 | 5 Oct 2026 | CVSS 6.5 | VillaTheme LookzyMissing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-97071 | 5 Oct 2026 | CVSS 5.3 | VillaTheme CURCYIncorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17. | |
| CVE-2026-101923 | 3 Oct 2026 | CVSS 8.1 | villatheme Photo Reviews for WooCommerceThe Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is… | |
| CVE-2026-100517 | 1 Oct 2026 | CVSS 7.5 | VillaTheme Photo Reviews for WooCommerceUnauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions. | |
| CVE-2026-102379 | 1 Oct 2026 | CVSS 8.5 | VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC BuilderImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for… | |
| CVE-2026-102390 | 1 Oct 2026 | CVSS 5.3 | VillaTheme AFFI – Affiliate Marketing for WooCommerceMissing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting… | |
| CVE-2026-94171 | 30 Sep 2026 | CVSS 7.1 | VillaTheme CURCYImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows… | |
| CVE-2026-97261 | 30 Sep 2026 | CVSS 5.3 | VillaTheme NotivoUnauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |