# VillaTheme vulnerabilities Source: https://junglewise.ai/threats/vendors/villatheme Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/villatheme.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 34 vulnerabilities in VillaTheme: 3 in the last 7 days and 26 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121770, was published on 11 November 2026. 9 vulnerabilities in the last four weeks, down 31% on the four before (13). 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 3 - Last 30 days: 8 - Last 90 days: 26 - All time: 34 (2 critical, 0 exploited in the wild) ## About VillaTheme A developer of plugins and extensions for the WordPress content management system. ## Latest VillaTheme vulnerabilities - [CVE-2026-121770: VillaTheme VISeek cross-site request forgery](https://junglewise.ai/threats/cve-2026-121770-cross-site-request-forgery-csrf-vulnerability-in-villatheme) (medium, CVSS 5.4, published 11 Nov 2026) - [CVE-2026-122663: VillaTheme CURCY broken access control in woo-multi-currency](https://junglewise.ai/threats/cve-2026-122663-missing-authorization-vulnerability-in-villatheme-curcy-woo) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-121775: VillaTheme CURCY woo-multi-currency broken access control](https://junglewise.ai/threats/cve-2026-121775-missing-authorization-vulnerability-in-villatheme-curcy-woo) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-112827: VillaTheme HANDMADE , Dropshipping for Etsy and WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-112827-missing-authorization-vulnerability-in-villatheme-handmade) (high, CVSS 7.1, published 29 Oct 2026) - [CVE-2026-112839: VillaTheme Customer Coupons for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-112839-missing-authorization-vulnerability-in-villatheme-customer) (medium, CVSS 4.3, published 26 Oct 2026) - [CVE-2026-110377: VillaTheme Bopo WooCommerce Product Bundle Builder broken access control](https://junglewise.ai/threats/cve-2026-110377-missing-authorization-vulnerability-in-villatheme-bopo) (medium, CVSS 5.3, published 26 Oct 2026) - [CVE-2026-110376: VillaTheme DEPART access control bypass in deposit payment](https://junglewise.ai/threats/cve-2026-110376-missing-authorization-vulnerability-in-villatheme-depart-depart) (medium, CVSS 4.3, published 26 Oct 2026) - [CVE-2026-103081: VillaTheme Salevo woo-boost-sales code injection](https://junglewise.ai/threats/cve-2026-103081-improper-control-of-generation-of-code-code-injection) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-103080: VillaTheme Salevo woo-boost-sales broken access control](https://junglewise.ai/threats/cve-2026-103080-external-control-of-assumed-immutable-web-parameter) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-103356: VillaTheme TMDS Dropshipping broken access control](https://junglewise.ai/threats/cve-2026-103356-missing-authorization-vulnerability-in-villatheme-tmds-tmds) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-103685: VillaTheme ALD broken access control in WooCommerce plugin](https://junglewise.ai/threats/cve-2026-103685-missing-authorization-vulnerability-in-villatheme-ald) (medium, CVSS 4.3, published 10 Oct 2026) - [CVE-2026-104398: VillaTheme AFFI Affiliate Marketing WooCommerce PHP object injection](https://junglewise.ai/threats/cve-2026-104398-deserialization-of-untrusted-data-vulnerability-in-villatheme) (critical, CVSS 9.8, published 10 Oct 2026) - [CVE-2026-103357: VillaTheme GIFT4U broken access control in gift4u-gift-cards-all-in-one-for-woo](https://junglewise.ai/threats/cve-2026-103357-missing-authorization-vulnerability-in-villatheme-gift4u-gift4u) (info, published 10 Oct 2026) - [CVE-2026-103071: VillaTheme Thank You Page Customizer for WooCommerce code injection](https://junglewise.ai/threats/cve-2026-103071-improper-control-of-generation-of-code-code-injection) (high, CVSS 7.5, published 10 Oct 2026) - [CVE-2026-97275: VillaTheme BuildKit input validation bypass in product builder](https://junglewise.ai/threats/cve-2026-97275-improper-validation-of-specified-quantity-in-input-vulnerability) (medium, CVSS 5.3, published 5 Oct 2026) - [CVE-2026-102383: VillaTheme Lookzy broken access control vulnerability](https://junglewise.ai/threats/cve-2026-102383-missing-authorization-vulnerability-in-villatheme-lookzy-woo) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-100515: VillaTheme Photo Reviews for WooCommerce reflected XSS](https://junglewise.ai/threats/cve-2026-100515-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 5 Oct 2026) - [CVE-2026-97071: VillaTheme CURCY broken access control in woo-multi-currency](https://junglewise.ai/threats/cve-2026-97071-incorrect-calculation-vulnerability-in-villatheme-curcy-woo-multi) (medium, CVSS 5.3, published 5 Oct 2026) - [CVE-2026-100517: Photo Reviews for WooCommerce insecure direct object references](https://junglewise.ai/threats/cve-2026-100517-unauthenticated-insecure-direct-object-references-idor-in-photo) (high, CVSS 7.5, published 1 Oct 2026) - [CVE-2026-102390: VillaTheme AFFI Affiliate Marketing for WooCommerce access control bypass](https://junglewise.ai/threats/cve-2026-102390-missing-authorization-vulnerability-in-villatheme-affi-affiliate) (medium, CVSS 5.3, published 1 Oct 2026) - [CVE-2026-102379: VillaTheme BuildKit Product Builder SQL injection](https://junglewise.ai/threats/cve-2026-102379-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.5, published 1 Oct 2026) - [CVE-2026-94171: CURCY cross-site scripting in Multi-Currency plugin](https://junglewise.ai/threats/cve-2026-94171-unauthenticated-cross-site-scripting-xss-in-curcy-2-2-16-versions) (high, CVSS 7.1, published 30 Sep 2026) - [CVE-2026-97261: Notivo sensitive data exposure in WordPress plugin](https://junglewise.ai/threats/cve-2026-97261-unauthenticated-sensitive-data-exposure-in-notivo-1-4-2-versions) (medium, CVSS 5.3, published 30 Sep 2026) - [CVE-2026-81786: Thank You Page Customizer for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-81786-thank-you-page-customizer-for-woocommerce-broken-access-control) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-81282: Product Variations Swatches for WooCommerce cross-site scripting](https://junglewise.ai/threats/cve-2026-81282-product-variations-swatches-for-woocommerce-cross-site-scripting) (medium, CVSS 6.5, published 3 Sep 2026) ## Most severe VillaTheme vulnerabilities - [CVE-2026-104398: VillaTheme AFFI Affiliate Marketing WooCommerce PHP object injection](https://junglewise.ai/threats/cve-2026-104398-deserialization-of-untrusted-data-vulnerability-in-villatheme) (critical, CVSS 9.8, published 10 Oct 2026) - [CVE-2026-54809: VillaTheme GIFT4U Blind SQL injection](https://junglewise.ai/threats/cve-2026-54809-villatheme-gift4u-blind-sql-injection) (critical, CVSS 9.3, published 17 Jun 2026) - [CVE-2026-82227: WPBulky SQL Injection in contributor functionality](https://junglewise.ai/threats/cve-2026-82227-wpbulky-sql-injection-in-contributor-functionality) (high, CVSS 8.5, published 28 Aug 2026) - [CVE-2026-102379: VillaTheme BuildKit Product Builder SQL injection](https://junglewise.ai/threats/cve-2026-102379-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.5, published 1 Oct 2026) - [CVE-2026-81786: Thank You Page Customizer for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-81786-thank-you-page-customizer-for-woocommerce-broken-access-control) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-103081: VillaTheme Salevo woo-boost-sales code injection](https://junglewise.ai/threats/cve-2026-103081-improper-control-of-generation-of-code-code-injection) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-100517: Photo Reviews for WooCommerce insecure direct object references](https://junglewise.ai/threats/cve-2026-100517-unauthenticated-insecure-direct-object-references-idor-in-photo) (high, CVSS 7.5, published 1 Oct 2026) - [CVE-2026-103071: VillaTheme Thank You Page Customizer for WooCommerce code injection](https://junglewise.ai/threats/cve-2026-103071-improper-control-of-generation-of-code-code-injection) (high, CVSS 7.5, published 10 Oct 2026) - [CVE-2026-112827: VillaTheme HANDMADE , Dropshipping for Etsy and WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-112827-missing-authorization-vulnerability-in-villatheme-handmade) (high, CVSS 7.1, published 29 Oct 2026) - [CVE-2026-100515: VillaTheme Photo Reviews for WooCommerce reflected XSS](https://junglewise.ai/threats/cve-2026-100515-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 5 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, down 31% on the four before (13). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 5 | 0 | 0 | | 5 Oct 2026 | 8 | 1 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## VillaTheme technologies - [VillaTheme Bopo](https://junglewise.ai/threats/technologies/bopo): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "VillaTheme vulnerabilities", https://junglewise.ai/threats/vendors/villatheme, 12 November 2026.