PatchTheCVEthemefic vulnerabilities
Recent CVEs affecting themefic products. 7 tracked.
themefic has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-07-01. Highest priority: CVE-2025-6220 (score 47/100).
- CVE-2025-6756 MEDIUM 6.4 UPGRADE The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
- CVE-2025-6220 HIGH 7.2 UPGRADE The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missin
- CVE-2025-6212 HIGH 7.2 UPGRADE The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
- CVE-2025-47550 MEDIUM 6.6 UPGRADE Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a
- CVE-2025-47549 CRITICAL 9.1 UPGRADE Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery a
- CVE-2025-24650 CRITICAL 9.1 UPGRADE Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web
- CVE-2024-12032 MEDIUM 6.5 UPGRADE The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Bookin
FAQ
How do I fix themefic vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is themefic being exploited right now?
None of the tracked themefic CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which themefic CVE should I patch first?
CVE-2025-6220 currently ranks highest (47/100): The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missin.