WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
holmes
Published
2026-01-01
Title
Holmes <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
holmes
Published
2026-02-25
Title
Holmes - Digital Agency WordPress Theme <= 1.7 - Unauthenticated Local File Inclusion
Slug
home-services
Published
2025-04-02
Title
Home Services <= 1.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
homelancer
Published
2025-10-16
Title
HomeLancer < 1.0.2 - Missing Authorization
Slug
homeo
Published
2026-02-21
Title
Homeo <= 1.2.59 - Authenticated (Contributor+) Local File Inclusion
Slug
homeroofer
Published
2025-10-10
Title
HomeRoofer < 2.12.0 - Unauthenticated Local File Inclusion
Slug
homevillas-real-estate
Published
2020-08-17
Title
Home Villas <= 2.2 - Multiple Cross-Site Scripting Issues
Slug
homevillas-real-estate
Published
2025-07-01
Title
Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
homey
Published
2025-01-13
Title
Homey <= 2.4.1 - Authenticated (Subscriber+) Privilege Escalation
Slug
homey
Published
2025-03-04
Title
Homey < 2.4.3 - Unauthenticated Privilege Escalation in homey_save_profile
Slug
homey
Published
2025-03-06
Title
Homey < 2.4.4 - Cross-Site Request Forgery to User Verification
Slug
homey
Published
2025-03-06
Title
Homey < 2.4.4 - Limited Authentication Bypass
Slug
homey
Published
2025-05-01
Title
Homey - Booking and Rentals WordPress Theme < 2.4.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion
Slug
homey
Published
2025-05-01
Title
Homey - Booking and Rentals WordPress Theme < 2.4.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion
Slug
homey
Published
2025-06-26
Title
Homey <= 2.4.5 - Reflected Cross-Site Scripting
Slug
homey
Published
2025-06-24
Title
Homey <= 2.4.5 - Unauthenticated SQL Injection
Slug
homlisti
Published
2026-08-20
Title
Homlisti <= 3.1.2 - Missing Authorization
Slug
honeypress
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
honor
Published
2026-02-25
Title
Honor | Shooting Club & Weapon and Gun Store Theme <= 2.3 - Unauthenticated Local File Inclusion
Slug
horizon
Published
2026-02-25
Title
Horizon <= 1.1 - Unauthenticated Local File Inclusion
Slug
hostiko
Published
2025-02-18
Title
Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Unauthenticated Local File Inclusion
Slug
hostiko
Published
2025-02-18
Title
Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Reflected Cross-Site Scripting
Slug
hostiko
Published
2026-01-20
Title
Hostiko < 94.3.6 - Unauthenticated Stored Cross-Site Scripting
Slug
hostmev2
Published
2026-01-13
Title
Hostme v2 <= 7.0 - Unauthenticated Arbitrary File Deletion
Slug
hostmev2
Published
2026-10-21
Title
Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated PHP Object Injection