WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
digital-store
Published
2015-04-20
Title
Digital Store < 1.3.3 - Unspecified XSS
Slug
digitally
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
digitally
Published
2024-10-15
Title
Digitally <= 1.0.8 - Reflected Cross-Site Scripting
Slug
dignitas-themes
Published
2015-03-04
Title
Dignitas 1.1.9 - Privilage Escalation
Slug
dimension
Published
2014-08-01
Title
Dimension - CSRF
Slug
diplomat
Published
2015-05-15
Title
ThemeMakers Themes - Information Disclosure
Slug
directory
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
disconnected
Published
2024-10-14
Title
Disconnected <= 1.3.0 - Reflected Cross-Site Scripting
Slug
discy
Published
2022-05-16
Title
Discy < 5.2 - Settings Update via CSRF
Slug
discy
Published
2022-05-16
Title
Discy < 5.2 - Restore Default Settings via CSRF
Slug
discy
Published
2022-07-12
Title
Discy < 5.0 - Subscriber+ Broken Access Control to change settings
Slug
discy
Published
2022-12-13
Title
WPQA < 5.9.3 - Missing validation lead to functionality abuse
Slug
divi
Published
2020-01-02
Title
ElegantThemes (Divi, Extra, divi-builder < 4.0.10) - Authenticated Code Injection
Slug
divi
Published
2018-10-30
Title
ElegantThemes (Divi, Extra, divi-builder) - Authenticated Stored Cross-Site Scripting (XSS)
Slug
divi
Published
2016-02-18
Title
ElegantThemes - Privilege Escalation
Slug
divi
Published
2020-08-03
Title
Elegant Themes (Divi 3.0 - 4.5.2, Extra 2.0 - 4.5.2, Divi Builder 2.0 - 4.5.2) - Authenticated Arbitrary File Upload
Slug
divi
Published
2023-12-22
Title
Divi < 4.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
divi
Published
2024-05-09
Title
Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Slug
diza
Published
2025-06-11
Title
Diza < 1.3.9 - Unauthenticated Local File Inclusion
Slug
diza
Published
2025-07-01
Title
Diza < 1.3.11 - Unauthenticated Local File Inclusion
Slug
doccure
Published
2025-09-08
Title
Doccure < 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
doccure
Published
2025-09-08
Title
Doccure Core < 1.5.4 - Unauthenticated Arbitrary File Upload
Slug
doccure
Published
2025-09-08
Title
Doccure < 1.5.1 - Unauthenticated Arbitrary User Password Change
Slug
doctreat
Published
2025-08-02
Title
Doctreat < 1.6.8 - Reflected Cross-Site Scripting
Slug
doctreat
Published
2025-08-02
Title
Doctreat < 1.6.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution