Themehigh
- Total products in the ecosystem
- 12
- Total vulnerabilities (90 days)
- 5
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Themehigh recorded 5 security vulnerabilities in the last 90 days across 5 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Checkout Field Editor for WooCommerce (Pro) had the most security vulnerabilities in the Themehigh ecosystem, with 1 vulnerabilities—approximately 20% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-122041Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX ActionCVE-2026-104926WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' ParameterCVE-2026-81534Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' ParameterCVE-2026-102392WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerabilityCVE-2026-9832Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-122041Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action | Exploitation statusNot exploited | Fix |
| Affected productCheckout Field Editor for WooCommerce (Pro) |
| Published11/07/2026 |
| SeverityCritical |
CVE-2026-104926WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter | Exploitation statusNot exploited | FixYes | Affected productWooCommerce Extra Product Options Pro | Published10/31/2026 | SeverityMedium |
|---|
CVE-2026-81534Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter | Exploitation statusNot exploited | FixYes | Affected productEmail Customizer for WooCommerce (Pro) | Published10/15/2026 | SeverityHigh |
|---|
CVE-2026-102392WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productExtra Product Options For WooCommerce | Custom Product Addons and Fields | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-9832Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint | Exploitation statusNot exploited | FixYes | Affected productPayment Gateway of Stripe for WooCommerce | Published09/19/2026 | SeverityMedium |
|---|
CVE-2026-14955Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter | Exploitation statusNot exploited | FixYes | Affected productCheckout Field Editor for WooCommerce (Pro) | Published07/25/2026 | SeverityMedium |
|---|
CVE-2026-45217WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productStripe Payment Gateway for WooCommerce | Published05/25/2026 | SeverityMedium |
|---|
CVE-2026-3231Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field | Exploitation statusNot exploited | FixYes | Affected productCheckout Field Editor (Checkout Manager) for WooCommerce | Published03/11/2026 | SeverityHigh |
|---|
CVE-2025-13974Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content | Exploitation statusNot exploited | FixYes | Affected productEmail Customizer for WooCommerce | Drag and Drop Email Templates Builder | Published01/07/2026 | SeverityMedium |
|---|
CVE-2025-67556WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productAdvanced FAQ Manager | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-67553WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productAdvanced FAQ Manager | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-49077WordPress Dynamic Pricing and Discount Rules plugin <= 2.2.9 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productDynamic Pricing and Discount Rules | Published06/06/2025 | SeverityMedium |
|---|
CVE-2024-8499Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice | Exploitation statusNot exploited | FixYes | Affected productCheckout Field Editor (Checkout Manager) for WooCommerce | Published10/04/2024 | SeverityMedium |
|---|
CVE-2024-35658WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerability | Exploitation statusNot exploited | FixYes | Affected productCheckout Field Editor for WooCommerce (Pro) | Published06/10/2024 | SeverityHigh |
|---|
CVE-2024-32781WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerability | Exploitation statusNot exploited | FixYes | Affected productEmail Customizer for WooCommerce | Published04/24/2024 | SeverityHigh |
|---|
CVE-2024-0705Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection | Exploitation statusNot exploited | FixYes | Affected productPayment Gateway of Stripe for WooCommerce | Published01/19/2024 | SeverityCritical |
|---|
CVE-2023-51545WordPress Job Manager & Career Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection | Exploitation statusNot confirmed | FixYes | Affected productJob Manager & Career – Manage job board listings, and recruitments | Published12/29/2023 | SeverityCritical |
|---|
CVE-2023-3162Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass | Exploitation statusNot exploited | FixYes | Affected productPayment Gateway of Stripe for WooCommerce | Published08/31/2023 | SeverityCritical |
|---|
18 Results | Page 1 of 1