WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
plato
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
playa
Published
2026-02-25
Title
Playa | Beach & Pool Club WordPress Theme <= 1.3.9 - Unauthenticated Local File Inclusion
Slug
playful
Published
2025-08-23
Title
Playful <= 1.19.0 - Unauthenticated Local File Inclusion
Slug
playhockey
Published
2026-10-08
Title
Let's Play | Hockey School & Winter Sports WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection
Slug
playroom
Published
2026-04-08
Title
Playroom < 1.5 - Unauthenticated PHP Object Injection
Slug
pliska
Published
2024-04-30
Title
Pliska < 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name
Slug
plumbing-parts
Published
2026-05-26
Title
Plumbing <= 1.6 - Unauthenticated PHP Object Injection
Slug
point-blog
Published
2024-07-09
Title
Point <= 1.1 - Cross-Site Request Forgery
Slug
police-department
Published
2026-02-27
Title
Police Department <= 2.17 - Unauthenticated Local File Inclusion
Slug
politican__
Published
2015-05-15
Title
ThemeMakers Themes - Information Disclosure
Slug
polka-dots
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
polka-dots
Published
2025-01-13
Title
polka dots <= 1.2 - Reflected Cross-Site Scripting
Slug
poloray
Published
2025-09-12
Title
Multiple Plugins and Themes by inkthemes - Unauthenticated Information Exposure
Slug
pont
Published
2015-06-26
Title
Multiple Themes - Privilige Escalation
Slug
pool-services
Published
2025-11-27
Title
Pool Services <= 3.3 - Unauthenticated Server-Side Request Forgery
Slug
popularis-verse
Published
2024-07-12
Title
Popularis Verse < 1.0.2 - Cross-Site Request Forgery
Slug
porto
Published
2024-05-08
Title
Porto < 7.1.1 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Slug
porto
Published
2024-05-08
Title
Porto < 7.1.1 - Unauthenticated Local File Inclusion via porto_ajax_posts
Slug
porto
Published
2026-02-27
Title
Porto <= 7.6.2 - Reflected Cross-Site Scripting
Slug
posterity
Published
2024-07-04
Title
Posterity < 3.4 - Cross-Site Request Forgery to Notice Dismissal
Slug
posterity
Published
2024-08-29
Title
Posterity <= 3.8 - Contributor+ Stored XSS
Slug
power-mag
Published
2025-01-07
Title
Power Mag <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
powerlift
Published
2025-11-27
Title
Powerlift < 3.2.1 - Missing Authorization
Slug
powerlift
Published
2026-01-16
Title
Powerlift < 3.2.1 - Unauthenticated Local File Inclusion
Slug
pranayama-yoga
Published
2026-02-18
Title
Pranayama Yoga < 1.2.3 - Missing Authorization