en
VillaTheme is a WordPress plugin developer specializing in WooCommerce extensions for online stores. Its products support functions such as currency management, cart recovery, product configuration, gifting, dropshipping, and store customization, and are delivered through its website with documentation and support.
As of 11/08/2026, VillaTheme recorded 32 security vulnerabilities in the last 90 days across 21 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Photo Reviews for WooCommerce had the most security vulnerabilities in the VillaTheme ecosystem, with 5 vulnerabilities—approximately 15.63% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-122663WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityCVE-2026-121775WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityCVE-2026-110251Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' ParameterCVE-2026-112827WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerabilityCVE-2026-112839WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-122663WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes |
| Published11/07/2026 |
| SeverityMedium |
CVE-2026-121775WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productCURCY | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-110251Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter | Exploitation statusNot confirmed | FixYes | Affected productRevopic – Photo Reviews for WooCommerce | Published10/31/2026 | SeverityMedium |
|---|
CVE-2026-112827WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productHANDMADE – Dropshipping for Etsy and WooCommerce | Published10/29/2026 | SeverityHigh |
|---|
CVE-2026-112839WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productCustomer Coupons for WooCommerce | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-111404WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability | Exploitation statusNot exploited | FixYes | Affected productPhoto Reviews for WooCommerce | Published10/26/2026 | SeverityLow |
|---|
CVE-2026-110377WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productBopo – WooCommerce Product Bundle Builder | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-110376WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productDEPART | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-103358WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productEmail Template Customizer for WooCommerce | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-103081WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productSalevo | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-103356WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productTMDS | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-103080WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productSalevo | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-104398WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productAFFI – Affiliate Marketing for WooCommerce | Published10/10/2026 | SeverityCritical |
|---|
CVE-2026-103685WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productALD – Dropshipping and Fulfillment for AliExpress and WooCommerce | Published10/10/2026 | SeverityMedium |
|---|
CVE-2026-103357WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productGIFT4U | Published10/10/2026 | SeverityMedium |
|---|
CVE-2026-103071WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productThank You Page Customizer for WooCommerce | Published10/10/2026 | SeverityHigh |
|---|
CVE-2026-100161Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter | Exploitation statusNot exploited | FixYes | Affected productPhoto Reviews for WooCommerce | Published10/10/2026 | SeverityHigh |
|---|
CVE-2026-103072WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productVillaTheme Core | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-97275WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability | Exploitation statusNot exploited | FixYes | Affected productBuildKit – Product Builder for WooCommerce – Custom PC Builder | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-97071WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productCURCY | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-102383WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLookzy | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-100515WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPhoto Reviews for WooCommerce | Published10/05/2026 | SeverityHigh |
|---|
CVE-2026-101923Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter | Exploitation statusNot exploited | FixYes | Affected productPhoto Reviews for WooCommerce | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-102390WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productAFFI – Affiliate Marketing for WooCommerce | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-102379WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productBuildKit – Product Builder for WooCommerce – Custom PC Builder | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-100517WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPhoto Reviews for WooCommerce | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-97261WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability | Exploitation statusNot exploited | FixYes | Affected productNotivo | Published09/30/2026 | SeverityMedium |
|---|
CVE-2026-94171WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productCURCY | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-81786WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productThank You Page Customizer for WooCommerce | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-81282WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productProduct Variations Swatches for WooCommerce | Published09/03/2026 | SeverityMedium |
|---|
CVE-2026-82227WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWPBulky | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-81277WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productSuggestion Engine for WooCommerce | Published08/27/2026 | SeverityHigh |
|---|
CVE-2026-57698WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productAbandoned Cart Recovery for WooCommerce | Published07/13/2026 | SeverityMedium |
|---|
CVE-2026-57422WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productBopo – WooCommerce Product Bundle Builder | Published07/13/2026 | SeverityHigh |
|---|
CVE-2026-11778CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter | Exploitation statusNot exploited | FixYes | Affected productCURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x | Published07/03/2026 | SeverityMedium |
|---|
CVE-2026-57352WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productALD – Dropshipping and Fulfillment for AliExpress and WooCommerce | Published07/02/2026 | SeverityMedium |
|---|
CVE-2026-57664WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerability | Exploitation statusNot exploited | FixYes | Affected productBopo – WooCommerce Product Bundle Builder | Published06/26/2026 | SeverityMedium |
|---|
CVE-2026-57324WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productGIFT4U | Published06/26/2026 | SeverityMedium |
|---|
CVE-2026-54809WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productGIFT4U | Published06/17/2026 | SeverityCritical |
|---|
CVE-2026-39593WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productHAPPY | Published05/21/2026 | SeverityMedium |
|---|
CVE-2026-40737WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productCOMPE | Published04/15/2026 | SeverityMedium |
|---|
CVE-2026-32526WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productAbandoned Cart Recovery for WooCommerce | Published03/25/2026 | SeverityHigh |
|---|
CVE-2026-28132WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWooCommerce Photo Reviews | Published02/26/2026 | SeverityMedium |
|---|
CVE-2025-67977WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productHAPPY | Published02/20/2026 | SeverityHigh |
|---|
CVE-2026-27052WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productSales Countdown Timer for WooCommerce and WordPress | Published02/19/2026 | SeverityHigh |
|---|
CVE-2026-2019Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting | Exploitation statusNot exploited | FixYes | Affected productCart All In One For WooCommerce | Published02/18/2026 | SeverityHigh |
|---|
CVE-2025-14541Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter | Exploitation statusNot exploited | FixYes | Affected productLucky Wheel Giveaway | Published02/11/2026 | SeverityHigh |
|---|
CVE-2025-14509Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags | Exploitation statusNot exploited | FixYes | Affected productLucky Wheel for WooCommerce – Spin a Sale | Published12/30/2025 | SeverityHigh |
|---|
CVE-2025-68556WordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productHAPPY | Published12/23/2025 | SeverityMedium |
|---|
CVE-2025-68550WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWPBulky | Published12/23/2025 | SeverityHigh |
|---|
80 Results | Page 1 of 2