WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
atlas
Published
2026-01-07
Title
Atlas <= 2.1.0 - Unauthenticated Local File Inclusion
Slug
atlast-business
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
attire
Published
2024-08-30
Title
Attire < 2.0.7 - Authenticated (Contributor+) PHP Object Injection
Slug
attorney
Published
2022-10-30
Title
Attorney <= 3 - Unauthenticated Arbitrary Page/Post Deletion
Slug
attorney
Published
2023-10-02
Title
Attorney <= 3 - Reflected XSS
Slug
au-pair-agency
Published
2026-03-04
Title
Au Pair Agency - Babysitting & Nanny Theme <= 1.2.2 - Unauthenticated PHP Object Injection
Slug
auberge
Published
2015-05-12
Title
Auberge Theme <= 1.4.4 - DOM Cross-Site Scripting (XSS)
Slug
auramart
Published
2025-03-24
Title
AuraMart <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
aurum-minimalist-shopping-theme
Published
2025-01-06
Title
Aurum - WordPress & WooCommerce Shopping Theme < 4.0.3 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import
Slug
authentic
Published
2015-03-03
Title
Authentic Theme - Arbitrary File Download
Slug
auto-car
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
auto-repair
Published
2026-01-13
Title
Auto Repair <= 22.6 - Reflected Cross-Site Scripting
Slug
automotive
Published
2026-02-26
Title
Automotive Car Dealership Business WordPress Theme < 13.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields
Slug
autoparts
Published
2026-01-12
Title
AutoParts <= 1.5.8 - Unauthenticated Local File Inclusion
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Subscriber+ Portfolio Permalinks Creation
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Contributor+ SSRF
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Contributor+ Arbitrary File Upload
Slug
avada
Published
2024-02-28
Title
Avada | Website Builder For WordPress & WooCommerce < 7.11.5 - Authenticated (Contributor+) Arbitrary File Upload
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Admin+) SQL Injection via entry
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
Slug
avanix
Published
2014-08-01
Title
Imediapixel - Cross-Site Scripting (XSS)
Slug
avantage
Published
2025-05-20
Title
Avantage < 2.5.0 - Unauthenticated PHP Object Injection