IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

ThemeHigh vulnerabilities (CVE)

CVE records published for ThemeHigh, newest first. Follow to get an email when a new one appears.

Payment Gateway of Stripe for WooCommerce 3Checkout Field Editor for WooCommerce (Pro) 3Advanced FAQ Manager 2Checkout Field Editor (Checkout Manager) for WooCommerce 2Email Customizer for WooCommerce | Drag and Drop Email Templates Builder 1Email Customizer for WooCommerce (Pro) 1Extra Product Options For WooCommerce | Custom Product Addons and Fields 1Job Manager & Career – Manage job board listings, and recruitments 1Stripe Payment Gateway for WooCommerce 1WooCommerce Extra Product Options Pro 1Dynamic Pricing and Discount Rules 1Email Customizer for WooCommerce 1
18 results
9.1Critical
CVE-2026-122041

Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action

Themehigh Checkout Field Editor for WooCommerce (Pro)

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. Th…

5.3Medium
CVE-2026-9832

Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

themehigh Payment Gateway of Stripe for WooCommerce

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoi…

6.5Medium
CVE-2026-14955

Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter

Themehigh Checkout Field Editor for WooCommerce (Pro)

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-l…

7.2High
CVE-2026-3231

Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field

themehigh Checkout Field Editor (Checkout Manager) for WooCommerce

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, an…

4.4Medium
CVE-2025-13974

Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content

themehigh Email Customizer for WooCommerce | Drag and Drop Email Templates Builder

The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible fo…

4.7Medium
CVE-2024-8499

Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice

themehigh Checkout Field Editor (Checkout Manager) for WooCommerce

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitizatio…

9.6Critical
CVE-2023-51545

WordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection

ThemeHigh Job Manager & Career – Manage job board listings, and recruitments

Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a …

9.8Critical
CVE-2023-3162

Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass

themehigh Payment Gateway of Stripe for WooCommerce

The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. Thi…

1.2%EPSS