WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
halpes
Published
2025-01-06
Title
Multiple Themes by gavias - Reflected XSS
Slug
hanani
Published
2025-09-05
Title
Hanani <= 1.2.11 - Unauthenticated Local File Inclusion
Slug
hara
Published
2025-06-11
Title
Hara < 1.2.11 - Unauthenticated Local File Inclusion
Slug
hara
Published
2025-12-15
Title
Hara < 1.2.18 - Authenticated (Contributor+) Local File Inclusion
Slug
harper
Published
2025-09-02
Title
Harper <= 1.13 - Unauthenticated Local File Inclusion
Slug
hasium
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
hasium
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
hasten-lite
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
headway
Published
2016-10-13
Title
Headway Theme < 3.8.9 - Authenticated Cross-Site Scripting (XSS)
Slug
healsoul
Published
2025-05-22
Title
Healsoul <= 2.0.2 - Unauthenticated Local File Inclusion
Slug
healthhub
Published
2025-08-23
Title
HealthHub <= 1.3.0 - Unauthenticated Local File Inclusion
Slug
heart
Published
2025-08-22
Title
Heart <= 1.8 - Unauthenticated Local File Inclusion
Slug
heartstar
Published
2025-08-22
Title
HeartStar <= 1.0.14 - Unauthenticated Local File Inclusion
Slug
hello-agency
Published
2024-08-16
Title
Hello Agency < 1.0.6 - Missing Authorization to Notice Dismissal
Slug
hello-fse-blog
Published
2025-06-19
Title
Hello FSE Blog <= 1.0.6 - Missing Authorization
Slug
hendon
Published
2026-01-06
Title
Hendon < 1.7 - Unauthenticated Local File Inclusion
Slug
hester
Published
2025-03-24
Title
Hester <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hestia
Published
2024-07-01
Title
Hestia < 3.1.3 - Cross-Site Request Forgery to Notice Dismissal
Slug
hestia
Published
2025-07-16
Title
Hestia < 3.2.11 - Missing Authorization
Slug
highlight
Published
2024-07-01
Title
Highlight < 1.0.30 - Cross-Site Request Forgery to Notice Dismissal
Slug
hillter
Published
2025-07-08
Title
Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
Slug
himalayas
Published
2024-05-07
Title
Himalayas < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
himalayas
Published
2024-07-22
Title
Himalayas <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
himer
Published
2022-12-13
Title
WPQA < 5.9.3 - Missing validation lead to functionality abuse
Slug
himer
Published
2024-06-12
Title
Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF