ThemeHigh vulnerabilities
We track 9 vulnerabilities in ThemeHigh products across 9 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
Latest ThemeHigh vulnerabilities
- 9.1 Critical severity
Checkout Field Editor for WooCommerce (Pro): Missing Authorization
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The
- 8.8 High severity
Email Customizer for WooCommerce (Pro): Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user
- 7.2 High severity
Checkout Field Editor (Checkout Manager) for…: Improper Neutralization of Input During Web Page Generation
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and
- 9.1 Critical severity
Checkout Field Editor for WooCommerce (Pro): Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, File Manipulation.This issue affects Checkout Field Editor for WooCommerce (Pro):
- 7.5 High severity
Email Customizer for WooCommerce: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for WooCommerce: from n/a through 2.6.0.
- 7.5 High severity
Payment Gateway of Stripe for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t
- 8.8 High severity
Job Manager & Career – Manage job board…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a t
- 9.8 Critical severity
Payment Gateway of Stripe for WooCommerce: Authentication Bypass Using an Alternate Path or Channel
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This
- 9.8 Critical severity
Multiple Shipping Address Woocommerce: Improper Neutralization of Special Elements used in an SQL Command
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injecti