Themehigh - vulnerabilities (CVEs)
19 CVEs in 17 products, 2 in the last 30 days, newest from 2026-10-15.
Products
- Checkout Field Editor For Woocommerce - 3 CVEs
- Payment Gateway Of Stripe For Woocommerce - 3 CVEs
- Advanced Faq Manager - 2 CVEs
- Checkout Field Editor Checkout Manager For Woocommerce - 2 CVEs
- Checkout Field Editor For Woocommerce Pro - 2 CVEs
- Job Manager & Career - 2 CVEs
- And Recruitments - 1 CVEs
- Dynamic Pricing And Discount Rules - 1 CVEs
- Email Customizer For Woocommerce - 1 CVEs
- Email Customizer For Woocommerce Drag And Drop Email Templates Builder - 1 CVEs
- Email Customizer For Woocommerce Pro - 1 CVEs
- Extra Product Options For Woocommerce Custom Product Addons And Fields - 1 CVEs
- Job Manager Career Manage Job Board Listings - 1 CVEs
- Multiple Shipping Addresses For Woocommerce - 1 CVEs
- Stripe Payment Gateway For Woocommerce - 1 CVEs
- Checkout Field Editor - 0 CVEs
- Multiple Shipping Addresses - 0 CVEs
Newest CVEs of Themehigh
- CVE-2026-81534 - CVSS 8.8 (high), 2026-10-15: The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to…
- CVE-2026-102392 - CVSS 7.2 (high), 2026-09-30: Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
- CVE-2026-9832 - CVSS 5.3 (medium), 2026-09-19: The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to,…
- CVE-2026-14955 - CVSS 6.5 (medium), 2026-07-25: The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the…
- CVE-2026-45217 - CVSS 6.5 (medium), 2026-05-25: Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery…
- CVE-2026-3231 - CVSS 7.2 (high), 2026-03-11: The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and…
- CVE-2025-13974 - CVSS 4.4 (medium), 2026-01-07: The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and…
- CVE-2025-67556 - CVSS 5.9 (medium), 2025-12-09: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager…
- CVE-2025-67553 - CVSS 6.5 (medium), 2025-12-09: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager…
- CVE-2025-49077 - CVSS 4.3 (medium), 2025-06-06: Cross-Site Request Forgery (CSRF) vulnerability in ThemeHigh Dynamic Pricing and Discount Rules discount-and-dynamic-pricing allows Cross Site Request…
- CVE-2024-8499 - CVSS 6.1 (medium), 2024-10-04: The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the…
- CVE-2024-35658 - CVSS 9.1 (critical), 2024-06-10: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows…
- CVE-2024-32781 - CVSS 7.5 (high), 2024-04-24: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for…
- CVE-2024-0705 - CVSS 9.8 (critical), 2024-01-19: The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including,…
- CVE-2023-51545 - CVSS 9.6 (critical), 2023-12-29: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and…
- CVE-2023-5906 - CVSS 7.5 (high), 2023-11-27: The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view…
- CVE-2023-3162 - CVSS 9.8 (critical), 2023-08-31: The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to…
- CVE-2022-3490 - CVSS 7.2 (high), 2022-11-28: The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could…
- CVE-2022-0783 - CVSS 9.8 (critical), 2022-05-02: The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL…
