WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
auto-car
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
auto-repair
Published
2026-01-13
Title
Auto Repair <= 22.6 - Reflected Cross-Site Scripting
Slug
automotive
Published
2026-02-26
Title
Automotive Car Dealership Business WordPress Theme < 13.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields
Slug
autoparts
Published
2026-01-12
Title
AutoParts <= 1.5.8 - Unauthenticated Local File Inclusion
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Subscriber+ Portfolio Permalinks Creation
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Contributor+ SSRF
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Contributor+ Arbitrary File Upload
Slug
avada
Published
2024-02-28
Title
Avada | Website Builder For WordPress & WooCommerce < 7.11.5 - Authenticated (Contributor+) Arbitrary File Upload
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Admin+) SQL Injection via entry
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
Slug
avanix
Published
2014-08-01
Title
Imediapixel - Cross-Site Scripting (XSS)
Slug
avantage
Published
2025-05-20
Title
Avantage < 2.5.0 - Unauthenticated PHP Object Injection
Slug
avante
Published
2026-05-08
Title
Avante < 3.0.5 - Reflected Cross-Site Scripting
Slug
aviana
Published
2026-02-25
Title
Aviana < 2.3.1 - Unauthenticated Local File Inclusion
Slug
avventure
Published
2026-03-02
Title
Avventure <= 1.1.12 - Unauthenticated Local File Inclusion
Slug
awake
Published
2014-08-01
Title
Awake 3.3 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Slug
awake
Published
2014-08-01
Title
Awake 3.3 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download
Slug
awake
Published
2015-02-11
Title
WordPress Slider Revolution - Local File Disclosure
Slug
awake
Published
2014-11-30
Title
WordPress Slider Revolution Shell Upload
Slug
awpbusinesspress
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
axioma
Published
2015-05-15
Title
ThemeMakers Themes - Information Disclosure