WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
prisma
Published
2025-08-22
Title
Prisma <= 1.10 - Unauthenticated Local File Inclusion
Slug
prolist
Published
2020-07-13
Title
Prolisting - Directory Listing < 1.27 - Unauthenticated Reflected XSS
Slug
promo
Published
2026-01-12
Title
Promo <= 1.3.0 - Unauthenticated Local File Inclusion
Slug
prostore
Published
2014-05-07
Title
Prostore < 1.1.3 - Open Redirection
Slug
prosume
Published
2014-08-01
Title
Site5 Wordpress Themes Email Spoofing
Slug
prowess
Published
2026-01-03
Title
Prowess <= 1.8.1 - Missing Authorization
Slug
prowess
Published
2026-01-25
Title
Prowess <= 2.3 - Authenticated (Contributor+) Local File Inclusion
Slug
pubnews
Published
2024-12-05
Title
Pubnews < 1.0.8 - Authenticated (Subscriber+) Arbitrary Plugin Installation
Slug
pubzinne
Published
2025-08-19
Title
Pubzinne <= 1.0.12 - Unauthenticated Local File Inclusion
Slug
puca
Published
2025-06-23
Title
Puca < 2.6.34 - Unauthenticated Local File Inclusion
Slug
puca
Published
2025-12-20
Title
Puca <= 2.6.39 - Authenticated (Contributor+) Local File Inclusion
Slug
punte
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
purity
Published
2014-08-01
Title
Purity - Multiple Cross-Site Scripting Vulnerabilities
Slug
purity-of-soul
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
purity-of-soul
Published
2024-08-16
Title
Purity Of Soul <= 1.9 - Reflected Cross-Site Scripting
Slug
purosa
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
purosa
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
purus
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
purus
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
purus
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
puzzles
Published
2025-02-11
Title
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL < 4.2.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
puzzles
Published
2025-02-12
Title
Puzzles < 4.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
puzzles
Published
2025-02-12
Title
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL < 4.2.5 - Unauthenticated PHP Object Injection