Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how villatheme compares to other vendors in security performance

View Risk Score →

Software

villatheme curcy
3
villatheme woocommerce thank you page customizer wordpress
3
villatheme affi – affiliate marketing for woocommerce
2
villatheme ald – dropshipping and fulfillment for aliexpress and woocommerce
2
villatheme buildkit – product builder for woocommerce – custom pc builder
2
villatheme email template customizer for woocommerce
2
villatheme gift4u
2
villatheme orders tracking for woocommerce
2
villatheme photo reviews for woocommerce
2
villatheme salevo
2
villatheme thank you page customizer for woocommerce
2
villatheme abandoned cart pro for woocommerce
1
villatheme abandoned cart recovery for woocommerce
1
villatheme abandoned cart recovery for woocommerce wordpress
1
villatheme cart all in one for woocommerce wordpress
1
villatheme compe compe-woo-compare-products
1
villatheme curcy woo-multi-currency
1
villatheme curcy wordpress
1
villatheme dropshipping and fulfillment for aliexpress and woocommerce wordpress
1
villatheme exmage
1
villatheme happy
1
villatheme happy (happy-helpdesk-support-ticket-system)
1
villatheme happy (wordpress plugin)
1
villatheme happy wordpress plugin
1
villatheme lookzy
1
villatheme product size chart for woocommerce wordpress
1
villatheme s2w - import shopify to woocommerce wordpress
1
villatheme sales countdown timer for woocommerce and wordpress
1
villatheme thank you page customizer for woocommerce wordpress
1
villatheme tmds – dropshipping for temu and woo
1
villatheme villatheme core
1
villatheme w2s wordpress
1
villatheme woocommerce email template customizer wordpress
1
villatheme woocommerce multi currency wordpress
1
villatheme woocommerce photo reviews
1
villatheme woocommerce photo reviews wordpress
1
villatheme woocommerce thank you page customizer
1
villatheme wpbulky
1
villatheme wpbulky wordpress
1

Villatheme SalevoWordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability

Risk 43
Severity
7.5
Code Injection
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.

First published (updated )
CVE-2026-103081

Villatheme Email Template Customizer for WooCommerceWordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

Risk 43
Severity
7.5
Code Injection
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.

First published (updated )
CVE-2026-103358

Villatheme SalevoWordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability

Risk 27
Severity
5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.

First published (updated )
CVE-2026-103080

Villatheme TMDS – Dropshipping for Temu and WooWordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability

Risk 34
Severity
5.4
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.

First published (updated )
CVE-2026-103356

Villatheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerceWordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability

Risk 22
Severity
4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.

First published (updated )
CVE-2026-103685

Villatheme AFFI – Affiliate Marketing for WooCommerceWordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

First published (updated )
CVE-2026-104398

Villatheme Thank You Page Customizer for WooCommerceWordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability

Risk 43
Severity
7.5
Code Injection
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

First published (updated )
CVE-2026-103071

Villatheme GIFT4UWordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability

Risk 33
Severity
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3.

First published (updated )
CVE-2026-103357

Villatheme VillaTheme CoreWordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability

Risk 22
Severity
4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.

First published (updated )
CVE-2026-103072

Villatheme BuildKit – Product Builder for WooCommerce – Custom PC BuilderWordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Risk 27
Severity
5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

First published (updated )
CVE-2026-97275

Villatheme LookzyWordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability

Risk 40
Severity
6.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.

First published (updated )
CVE-2026-102383

Villatheme Photo Reviews for WooCommerceWordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.

First published (updated )
CVE-2026-100515

Villatheme CURCY woo-multi-currencyWordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability

Risk 19
Severity
5.3
EPSS
0.19%
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.

First published (updated )
CVE-2026-97071

Villatheme Photo Reviews for WooCommerceWordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.

First published (updated )
CVE-2026-100517

Villatheme BuildKit – Product Builder for WooCommerce – Custom PC BuilderWordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability

Risk 55
Severity
8.5
SQL Injection
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

First published (updated )
CVE-2026-102379

Villatheme AFFI – Affiliate Marketing for WooCommerceWordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability

Risk 27
Severity
5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9.

First published (updated )
CVE-2026-102390

Villatheme CURCYWordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

First published (updated )
CVE-2026-94171

Villatheme GIFT4UWordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability

Risk 61
Severity
9.3
SQL Injection
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection.

This issue affects GIFT4U: from n/a through 1.0.10.

First published (updated )
CVE-2026-54809

Villatheme HAPPY (WordPress plugin)WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability

Risk 40
Severity
6.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects HAPPY: from n/a through 1.0.10.

First published (updated )
CVE-2026-39593

Villatheme COMPE compe-woo-compare-productsWordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability

Risk 27
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through <= 1.1.4.

First published (updated )
CVE-2026-40737

Villatheme Abandoned Cart Recovery for WooCommerceWordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Stored XSS.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.10.

First published (updated )
CVE-2026-32526

Villatheme Sales Countdown Timer for WooCommerce and WordPressWordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability

Risk 51
Severity
7.5
EPSS
0.13%
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VillaTheme Sales Countdown Timer for WooCommerce and WordPress allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a before 1.1.9.

1 / 2
Source: NVD

Remedy

Update the WordPress Sales Countdown Timer for WooCommerce and WordPress plugin to the latest available version (at least 1.1.9).
First published (updated )
CVE-2026-27052

Villatheme WPBulkyWordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability

Risk 47
Severity
7.6
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky allows Blind SQL Injection.This issue affects WPBulky: from n/a through 1.1.13.

1 / 2
Source: NVD

Remedy

Update the WordPress WPBulky Plugin to the latest available version (at least 1.1.14).
First published (updated )
CVE-2025-68550

Villatheme HAPPY WordPress pluginWordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability

Risk 27
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through 1.0.9.

1 / 2
Source: NVD

Remedy

Update the WordPress HAPPY Plugin to the latest available version (at least 1.0.10).
First published (updated )
CVE-2025-68556

Villatheme HAPPYWordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability

Risk 87
Severity
10
Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Remote Code Inclusion.This issue affects HAPPY: from n/a through <= 1.0.7.

First published (updated )
CVE-2025-49372

Villatheme Email Template Customizer for WooCommerceWordPress Email Template Customizer for WooCommerce plugin <= 1.2.17 - Cross Site Scripting (XSS) vulnerability

Risk 40
Severity
5.9
XSS
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.17.

First published (updated )
CVE-2025-64200

Villatheme WooCommerce Photo ReviewsWordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.3.13.

1 / 2
Source: MITRE
First published (updated )
CVE-2025-47570

Villatheme HAPPY (happy-helpdesk-support-ticket-system)WordPress HAPPY plugin <= 1.0.6 - Broken Access Control vulnerability

Risk 38
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.6.

1 / 2
Source: NVD

Remedy

Update the WordPress HAPPY plugin to the latest available version (at least 1.0.7).
First published (updated )
CVE-2025-53571

Villatheme Thank You Page Customizer for WooCommerceWordPress Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Broken Access Control Vulnerability

Risk 38
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thank You Page Customizer for WooCommerce – Increase Your Sales: from n/a through 1.1.7.

1 / 2
Source: NVD
First published (updated )
CVE-2025-30993

Villatheme Abandoned Cart Pro for WooCommerceAbandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload

Risk 79
Severity
8.8
Malicious File Upload
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcapaddtocartpopupuploadfiles function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.

First published (updated )
CVE-2025-4387

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203