PatchTheCVE: tourfichttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-24650: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web https://patchthecve.com/cve/CVE-2025-24650.htmlhttps://patchthecve.com/cve/CVE-2025-24650.htmlWed, 17 Jun 2026 08:59:22 +0000CRITICAL 9.1: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.CVE-2024-12032: The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Bookinhttps://patchthecve.com/cve/CVE-2024-12032.htmlhttps://patchthecve.com/cve/CVE-2024-12032.htmlWed, 17 Jun 2026 06:58:55 +0000MEDIUM 6.5: The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiry_id' parameter of the 'tf_enquiry_reply_email_callback' function in all versions up to, and including, 2.15.3 due to insCVE-2024-8319: The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includhttps://patchthecve.com/cve/CVE-2024-8319.htmlhttps://patchthecve.com/cve/CVE-2024-8319.htmlWed, 17 Jun 2026 08:22:21 +0000MEDIUM 4.3: The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_orCVE-2024-29137: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefichttps://patchthecve.com/cve/CVE-2024-29137.htmlhttps://patchthecve.com/cve/CVE-2024-29137.htmlWed, 17 Jun 2026 07:22:29 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.CVE-2024-29136: Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from nhttps://patchthecve.com/cve/CVE-2024-29136.htmlhttps://patchthecve.com/cve/CVE-2024-29136.htmlWed, 17 Jun 2026 07:22:29 +0000HIGH 8.5: Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.CVE-2024-29135: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Thttps://patchthecve.com/cve/CVE-2024-29135.htmlhttps://patchthecve.com/cve/CVE-2024-29135.htmlWed, 17 Jun 2026 07:22:28 +0000CRITICAL 9.9: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.CVE-2024-29134: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefichttps://patchthecve.com/cve/CVE-2024-29134.htmlhttps://patchthecve.com/cve/CVE-2024-29134.htmlWed, 17 Jun 2026 07:22:28 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.8.