The7 Classic

dt-the7

Vulnerabilities:

9

Last Updated:

September 9, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2026-10-05
Title
The7 — Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2026-05-14
Title
The7 < 14.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
Fixed in
Fixed in 14.3.3
CVSS
5.5 (medium)
Published
2025-10-24
Title
The7 — Ultimate WordPress & WooCommerce Theme < 12.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
Fixed in
Fixed in 12.9.2
CVSS
6.4 (medium)
Published
2025-10-05
Title
The7 < 12.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 12.9.0
CVSS
6.4 (medium)
Published
2025-10-04
Title
The7 < 12.8.1.1 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 12.8.1.1
CVSS
7.5 (high)
Published
2025-08-09
Title
The7 < 12.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes
Fixed in
Fixed in 12.7.0
CVSS
6.4 (medium)
Published
2024-06-24
Title
The7 — Website and eCommerce Builder for WordPress < 11.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute
Fixed in
Fixed in 11.14.0
CVSS
6.4 (medium)
Published
2023-04-06
Title
The7 < 11.6.1 - Reflected XSS
Fixed in
Fixed in 11.6.1
CVSS
7.1 (high)
Published
2015-04-25
Title
The7 Premium Theme < 2.1.1 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.1.1
CVSS
6.1 (medium)