Themehigh
Monthly
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
Reflected cross-site scripting in ThemeHigh's WooCommerce Extra Product Options Pro plugin, affecting all versions up to and including 3.3.2, lets unauthenticated attackers inject arbitrary browser-side script through the '<fieldname>_start' and '<fieldname>_end' parameters of a Date & Time Range Picker extra field. The root cause is missing input sanitization combined with missing output escaping when those parameter values are reflected back into a WooCommerce product page. The attack is only reachable on product pages where a Date & Time Range Picker field has actually been configured, and the field name needed to build the payload is already visible in the page source, so discovery requires no prior knowledge; a victim must still be convinced to click a crafted link before the script runs in their session. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Authenticated directory traversal in Checkout Field Editor Pro for WooCommerce up to 3.7.7 enables subscriber-level attackers to read arbitrary server files. Exploitation leverages the 'thwcfe_legacy_file' parameter. No active exploitation or public exploit code is currently known, and EPSS indicates low exploitation probability.
Authentication bypass in ThemeHigh's Stripe Payment Gateway for WooCommerce (all versions through 5.0.7) allows unauthenticated remote attackers to exploit the plugin's password recovery flow to gain unauthorized access, affecting both data integrity and availability (CVSS 6.5). The flaw is classified as CWE-288 - Authentication Bypass Using an Alternate Path or Channel - meaning the plugin exposes an alternative code path that circumvents normal authentication controls. No public exploit code has been identified at time of analysis, and CISA has not added this to KEV, though SSVC flags the attack as automatable with partial technical impact.
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, File. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career - Manage job board listings, and recruitments.4.4. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
Reflected cross-site scripting in ThemeHigh's WooCommerce Extra Product Options Pro plugin, affecting all versions up to and including 3.3.2, lets unauthenticated attackers inject arbitrary browser-side script through the '<fieldname>_start' and '<fieldname>_end' parameters of a Date & Time Range Picker extra field. The root cause is missing input sanitization combined with missing output escaping when those parameter values are reflected back into a WooCommerce product page. The attack is only reachable on product pages where a Date & Time Range Picker field has actually been configured, and the field name needed to build the payload is already visible in the page source, so discovery requires no prior knowledge; a victim must still be convinced to click a crafted link before the script runs in their session. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Authenticated directory traversal in Checkout Field Editor Pro for WooCommerce up to 3.7.7 enables subscriber-level attackers to read arbitrary server files. Exploitation leverages the 'thwcfe_legacy_file' parameter. No active exploitation or public exploit code is currently known, and EPSS indicates low exploitation probability.
Authentication bypass in ThemeHigh's Stripe Payment Gateway for WooCommerce (all versions through 5.0.7) allows unauthenticated remote attackers to exploit the plugin's password recovery flow to gain unauthorized access, affecting both data integrity and availability (CVSS 6.5). The flaw is classified as CWE-288 - Authentication Bypass Using an Alternate Path or Channel - meaning the plugin exposes an alternative code path that circumvents normal authentication controls. No public exploit code has been identified at time of analysis, and CISA has not added this to KEV, though SSVC flags the attack as automatable with partial technical impact.
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, File. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career - Manage job board listings, and recruitments.4.4. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.