Themehigh develops a focused portfolio of WordPress and WooCommerce plugins for e-commerce functionality, including checkout field customization and shipping management tools that operate in the payment and order-processing context. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, reflecting the high-value target that payment-adjacent WordPress plugins represent; the recurring weakness classes include cross-site request forgery, deserialization of untrusted data, path traversal, cross-site scripting, and SQL injection—all characteristic of web-application input handling and access control in commerce platforms. Defenders should treat this vendor's plugin updates as urgent, particularly in production e-commerce environments; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Themehigh over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-0783CRITICAL The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX ac | May 2, 2022 | 9.8 | 45 | NO | YES |
CVE-2023-51545HIGH Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affect | Dec 29, 2023 | 8.8 | 27 | NO | NO |
CVE-2024-35658CRITICAL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, F | Jun 10, 2024 | 9.1 | 25 | NO | NO |
CVE-2022-3490HIGH The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users | Nov 28, 2022 | 7.2 | 22 | NO | NO |
CVE-2023-5906HIGH The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private fil | Nov 27, 2023 | 7.5 | 20 | NO | NO |
CVE-2024-8499MEDIUM The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in | Oct 4, 2024 | 6.1 | 19 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Themehigh.
Media articles that mention a CVE ID that affects a product developed by Themehigh — matched by CVE ID, not by vendor name.