WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
halpes
Published
2025-01-06
Title
Multiple Themes by gavias - Reflected XSS
Slug
hanani
Published
2025-09-05
Title
Hanani <= 1.2.11 - Unauthenticated Local File Inclusion
Slug
handyman-services
Published
2026-03-03
Title
Handyman <= 1.4 - Unauthenticated PHP Object Injection
Slug
happy-baby
Published
2026-02-27
Title
Happy Baby <= 1.2.12 - Unauthenticated Local File Inclusion
Slug
hara
Published
2025-06-11
Title
Hara < 1.2.11 - Unauthenticated Local File Inclusion
Slug
hara
Published
2025-12-15
Title
Hara < 1.2.18 - Authenticated (Contributor+) Local File Inclusion
Slug
hara
Published
2026-02-04
Title
Hara < 1.2.18 - Unauthenticated Local File Inclusion
Slug
harper
Published
2025-09-02
Title
Harper <= 1.13 - Unauthenticated Local File Inclusion
Slug
hasium
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
hasium
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
hasten-lite
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
headway
Published
2016-10-13
Title
Headway Theme < 3.8.9 - Authenticated Cross-Site Scripting (XSS)
Slug
healer
Published
2026-03-02
Title
Healer - Doctor, Clinic & Medical WordPress <= 1.0.0 - Unauthenticated Local File Inclusion
Slug
healsoul
Published
2025-05-22
Title
Healsoul < 2.2.4 - Unauthenticated Local File Inclusion
Slug
healthfirst
Published
2026-02-11
Title
HealthFirst <= 1.0.1 - Unauthenticated Local File Inclusion
Slug
healthhub
Published
2025-08-23
Title
HealthHub <= 1.3.0 - Unauthenticated Local File Inclusion
Slug
heart
Published
2025-08-22
Title
Heart <= 1.8 - Unauthenticated Local File Inclusion
Slug
heartstar
Published
2025-08-22
Title
HeartStar <= 1.0.14 - Unauthenticated Local File Inclusion
Slug
helion
Published
2026-03-02
Title
Helion | Personal Portfolio & Agency WordPress Theme <= 1.1.12 - Unauthenticated Local File Inclusion
Slug
hello-agency
Published
2024-08-16
Title
Hello Agency < 1.0.6 - Missing Authorization to Notice Dismissal
Slug
hello-fse
Published
2026-01-30
Title
Hello FSE <= 1.0.6 - Missing Authorization
Slug
hello-fse-blog
Published
2025-06-19
Title
Hello FSE Blog <= 1.0.6 - Missing Authorization
Slug
helvig
Published
2026-02-25
Title
Helvig <= 1.0 - Unauthenticated Local File Inclusion
Slug
hendon
Published
2026-01-06
Title
Hendon < 1.7 - Unauthenticated Local File Inclusion
Slug
hester
Published
2025-03-24
Title
Hester <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting