ThemeComplete vulnerabilities

Products

• Extra Checkout Options - addon for Extra Product Options plugin 1
• Extra Product Options & Add-Ons for WooCommerce 1

Latest ThemeComplete CVEs

Newest publication first

1. CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

   Published 2026-08-18

   High·CVSS 7.5

   Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

2. CVE-2026-14270 Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings

   Published 2026-07-29

   High·CVSS 8.8

   The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() fun...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.