WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
auberge
Published
2015-05-12
Title
Auberge Theme <= 1.4.4 - DOM Cross-Site Scripting (XSS)
Slug
audrey
Published
2026-06-29
Title
Audrey <= 1.5 - Unauthenticated Local File Inclusion
Slug
auramart
Published
2025-03-24
Title
AuraMart <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
aurum-minimalist-shopping-theme
Published
2025-01-06
Title
Aurum - WordPress & WooCommerce Shopping Theme < 4.0.3 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import
Slug
authentic
Published
2015-03-03
Title
Authentic Theme < 2.0.5 - Arbitrary File Download
Slug
auto-car
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
auto-repair
Published
2026-01-13
Title
Auto Repair <= 22.6 - Reflected Cross-Site Scripting
Slug
automotive
Published
2026-02-26
Title
Automotive Car Dealership Business WordPress Theme < 13.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields
Slug
automotive
Published
2026-06-30
Title
Automotive Car Dealership Business WordPress Theme <= 13.3.3 - Reflected Cross-Site Scripting
Slug
automotive
Published
2026-05-28
Title
Automotive Car Dealership Business WordPress Theme < 13.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details
Slug
autoparts
Published
2026-01-12
Title
AutoParts <= 1.5.8 - Unauthenticated Local File Inclusion
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Subscriber+ Portfolio Permalinks Creation
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Contributor+ SSRF
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Slug
avada
Published
2024-01-29
Title
Avada < 7.11.2 - Contributor+ Arbitrary File Upload
Slug
avada
Published
2024-02-28
Title
Avada | Website Builder For WordPress & WooCommerce < 7.11.5 - Authenticated (Contributor+) Arbitrary File Upload
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Admin+) SQL Injection via entry
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
avada
Published
2024-03-20
Title
Avada < 7.11.7 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
Slug
avala
Published
2026-10-08
Title
Avala <= 1.1.4 - Unauthenticated PHP Object Injection
Slug
avanix
Published
2014-08-01
Title
Imediapixel - Cross-Site Scripting (XSS)
Slug
avantage
Published
2025-05-20
Title
Avantage < 2.5.0 - Unauthenticated PHP Object Injection
Slug
avante
Published
2026-05-08
Title
Avante < 3.0.5 - Reflected Cross-Site Scripting
Slug
aviana
Published
2026-02-25
Title
Aviana < 2.3.1 - Unauthenticated Local File Inclusion