WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
studiozen
Published
2014-08-01
Title
Studio Zen - Multiple Script Direct Request Path Disclosure
Slug
style
Published
2015-05-15
Title
ThemeMakers Themes - Information Disclosure
Slug
suffice
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
superio
Published
2022-12-09
Title
Superio - Job Board < 1.2.33 - Subscriber+ Stored Cross-Site Scripting
Slug
superlist
Published
2019-12-02
Title
Superlist <= 2.9.2 - Stored Cross-Site Scripting (XSS)
Slug
supreme-directory
Published
2018-08-19
Title
Supreme Directory Theme <= 1.1.8 - Unauthenticated Cross-Site Scripting (XSS)
Slug
sw_maxshop
Published
2025-12-30
Title
MaxShop <= 3.6.20 - Unauthenticated Local File Inclusion
Slug
swape
Published
2018-02-08
Title
Swape Theme - Authentication Bypass and Stored XSS
Slug
sweet-dessert
Published
2025-06-03
Title
Sweet Dessert < 1.1.13 - Unauthenticated PHP Object Injection
Slug
sweetdate
Published
2024-12-03
Title
Sweet Date < 3.8.0 - Unauthenticated Privilege Escalation
Slug
sweetjane
Published
2026-01-02
Title
Sweet Jane <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
swing-lite
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
switchblade
Published
2014-08-01
Title
Switchblade 1.3 - Arbitrary File Upload
Slug
sydney
Published
2025-09-16
Title
Sydney < 2.57 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update