WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
diveit
Published
2025-12-31
Title
DiveIt <= 1.4.3 - Unauthenticated Local File Inclusion
Slug
divi
Published
2020-01-02
Title
ElegantThemes (Divi, Extra, divi-builder < 4.0.10) - Authenticated Code Injection
Slug
divi
Published
2018-10-30
Title
ElegantThemes (Divi, Extra, divi-builder) - Authenticated Stored Cross-Site Scripting (XSS)
Slug
divi
Published
2016-02-18
Title
ElegantThemes - Privilege Escalation
Slug
divi
Published
2020-08-03
Title
Elegant Themes (Divi 3.0 - 4.5.2, Extra 2.0 - 4.5.2, Divi Builder 2.0 - 4.5.2) - Authenticated Arbitrary File Upload
Slug
divi
Published
2023-12-22
Title
Divi < 4.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
divi
Published
2024-05-09
Title
Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Slug
dixon
Published
2026-02-27
Title
Dixon <= 1.4.2.1 - Unauthenticated Local File Inclusion
Slug
diza
Published
2025-06-11
Title
Diza < 1.3.9 - Unauthenticated Local File Inclusion
Slug
diza
Published
2025-07-01
Title
Diza < 1.3.11 - Unauthenticated Local File Inclusion
Slug
diza
Published
2025-12-23
Title
Diza < 1.3.16 - Authenticated (Contributor+) Local File Inclusion
Slug
diza
Published
2026-02-11
Title
Diza < 1.3.16 - Unauthenticated Local File Inclusion
Slug
dj-rainflow
Published
2025-08-19
Title
DJ Rainflow <= 1.3.13 - Unauthenticated Local File Inclusion
Slug
doccure
Published
2025-09-08
Title
Doccure < 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
doccure
Published
2025-09-08
Title
Doccure Core < 1.5.4 - Unauthenticated Arbitrary File Upload
Slug
doccure
Published
2025-09-08
Title
Doccure < 1.5.1 - Unauthenticated Arbitrary User Password Change
Slug
doctreat
Published
2025-08-02
Title
Doctreat < 1.6.8 - Reflected Cross-Site Scripting
Slug
doctreat
Published
2025-08-02
Title
Doctreat < 1.6.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Slug
doko
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
dolcino
Published
2026-01-02
Title
Dolcino <= 1.6 - Authenticated (subscriber+) Insecure Direct Object Reference
Slug
dolcino
Published
2026-02-25
Title
Dolcino - Pastry and Cake Shop WordPress Theme <= 1.6 - Unauthenticated Local File Inclusion
Slug
domnoo
Published
2025-06-25
Title
Domnoo < 1.52.1 - Unauthenticated Local File Inclusion
Slug
donpeppe
Published
2026-01-03
Title
Don Peppe <= 1.3 - Missing Authorization
Slug
donpeppe
Published
2026-03-03
Title
Don Peppe - Pizza and Fast Food WordPress Theme <= 1.3 - Unauthenticated Local File Inclusion
Slug
dor
Published
2025-04-17
Title
Dør < 2.4.1 - Unauthenticated Local File Inclusion