WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
patricia-lite
Published
2024-07-09
Title
Patricia Lite <= 1.2.3 - Cross-Site Request Forgery
Slug
pawfriends
Published
2025-12-30
Title
PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Cross-Site Request Forgery
Slug
pawfriends
Published
2026-02-17
Title
PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Unauthenticated Local File Inclusion
Slug
pawfriends
Published
2026-02-17
Title
PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
peakshops
Published
2026-01-23
Title
PeakShops < 1.5.9 - Unauthenticated Local File Inclusion
Slug
peakshops
Published
2026-01-23
Title
PeakShops <= 1.5.9 - Authenticated (Contributor+) PHP Object Injection
Slug
pearl
Published
2025-02-23
Title
Pearl - Corporate Business < 3.4.8 - Unauthenticated Local File Inclusion
Slug
pearsonspecter
Published
2025-12-31
Title
Pearson Specter <= 1.11.3 - Unauthenticated Local File Inclusion
Slug
pelicula-video-production-and-movie-theme
Published
2026-03-20
Title
Pelicula < 1.10 - Unauthenticated PHP Object Injection
Slug
pendulum
Published
2026-03-20
Title
Pendulum < 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
Slug
pennews
Published
2025-12-14
Title
PenNews < 6.7.4 - Missing Authorization
Slug
pennews
Published
2025-08-02
Title
PenNews < 6.7.3 - Unauthenticated Local File Inclusion
Slug
perfect-portfolio
Published
2022-02-14
Title
Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify
Slug
perfect-portfolio
Published
2024-06-28
Title
Perfect Portfolio < 1.2.1 - Cross-Site Request Forgery to Notice Dismissal
Slug
performag
Published
2021-03-24
Title
All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion
Slug
performag
Published
2021-03-24
Title
All Thrive Themes and Plugins - Unauthenticated Option Update
Slug
persuasion
Published
2014-08-01
Title
Multiple Themes - PrettyPhoto DOM XSS
Slug
persuasion
Published
2014-08-01
Title
Persuasion <= 2.4 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Slug
persuasion
Published
2014-08-01
Title
Persuasion <= 2.4 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download
Slug
petclub
Published
2026-03-03
Title
Pets Club <= 2.3 - Unauthenticated PHP Object Injection
Slug
petermason
Published
2026-02-27
Title
Peter Mason <= 1.4.5 - Unauthenticated Local File Inclusion
Slug
petsland
Published
2025-12-31
Title
Pets Land <= 1.2.8 - Unauthenticated Local File Inclusion
Slug
petsworld
Published
2025-05-21
Title
Pet World <= 2.8 - Authenticated (Subscriber+) PHP Object Injection
Slug
phlox
Published
2026-01-05
Title
Phlox < 2.17.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML Attribute
Slug
phlox-pro
Published
2024-08-20
Title
Phlox PRO < 5.16.5 - Reflected Cross-Site Scripting via Search Parameters