WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
hestia
Published
2024-07-01
Title
Hestia < 3.1.3 - Cross-Site Request Forgery to Notice Dismissal
Slug
hestia
Published
2025-07-16
Title
Hestia < 3.2.11 - Missing Authorization
Slug
highlight
Published
2024-07-01
Title
Highlight < 1.0.30 - Cross-Site Request Forgery to Notice Dismissal
Slug
hillter
Published
2025-07-08
Title
Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
Slug
himalayas
Published
2024-05-07
Title
Himalayas < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
himalayas
Published
2024-07-22
Title
Himalayas <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
himer
Published
2022-12-13
Title
WPQA < 5.9.3 - Missing validation lead to functionality abuse
Slug
himer
Published
2024-06-12
Title
Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF
Slug
himer
Published
2024-06-12
Title
Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR
Slug
himer
Published
2024-06-12
Title
Himer - Social Questions and Answers < 2.1.1 - Bypass Poll Voting Restrictions via CSRF
Slug
himer
Published
2024-06-12
Title
Himer - Social Questions and Answers < 2.1.1 - Contributor+ Stored XSS
Slug
himer
Published
2024-06-12
Title
Himer - Social Questions and Answers < 2.1.1 - Multiple CSRF on the Group Section
Slug
himer
Published
2024-07-15
Title
Himer - Social Questions and Answers < 2.1.3 - CSRF While Sending the Invites
Slug
histudy
Published
2025-10-13
Title
HiStudy - Online Courses & Education Template < 3.1.0 - Unauthenticated SQL Injection
Slug
hive-lite
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
hmd
Published
2024-12-14
Title
hmd < 2.2 - Reflected Cross-Site Scripting
Slug
hobo
Published
2025-12-31
Title
Hobo <= 1.0.10 - Unauthenticated Local File Inclusion
Slug
holding_pattern
Published
2015-02-22
Title
Holding Pattern Theme <= 0.6 - Arbitrary File Upload
Slug
holmes
Published
2026-01-01
Title
Holmes <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
holmes
Published
2026-02-25
Title
Holmes - Digital Agency WordPress Theme <= 1.7 - Unauthenticated Local File Inclusion
Slug
home-services
Published
2025-04-02
Title
Home Services <= 1.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
homelancer
Published
2025-10-16
Title
HomeLancer < 1.0.2 - Missing Authorization
Slug
homeroofer
Published
2025-10-10
Title
HomeRoofer < 2.12.0 - Unauthenticated Local File Inclusion
Slug
homevillas-real-estate
Published
2020-08-17
Title
Home Villas <= 2.2 - Multiple Cross-Site Scripting Issues
Slug
homevillas-real-estate
Published
2025-07-01
Title
Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion