WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
u-design
Published
2015-05-20
Title
uDesign Theme 1.8.0-2.7.9 - DOM Cross-Site Scripting (XSS)
Slug
u-design
Published
2024-04-23
Title
UDesign < 4.13.6 - Reflected Cross-Site Scripting
Slug
udesign
Published
2025-01-24
Title
uDesign < 4.11.3 - Missing Authorization
Slug
ultimatum
Published
2015-02-11
Title
WordPress Slider Revolution - Local File Disclosure
Slug
ultimatum
Published
2014-11-30
Title
WordPress Slider Revolution Shell Upload
Slug
ultralight
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
ultrapress
Published
2024-09-30
Title
UltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection
Slug
umberto
Published
2025-05-21
Title
Umberto <= 1.2.8 - Unauthenticated PHP Object Injection
Slug
unakit
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
unakit
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
uncode
Published
2025-02-17
Title
Uncode < 2.9.1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description
Slug
uncode
Published
2025-02-17
Title
Uncode < 2.9.1.7 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed
Slug
uncode
Published
2025-02-17
Title
Uncode < 2.9.1.7 - Subscriber+ Arbitrary File Read in uncode_recordMedia
Slug
uncode
Published
2025-08-26
Title
Uncode < 2.9.4.4 - Reflected Cross-Site Scripting
Slug
uncode-lite
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
unicamp
Published
2025-08-14
Title
Unicamp < 2.6.4 - Unauthenticated Local File Inclusion
Slug
unicon-lite
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
unique
Published
2024-04-30
Title
Unique <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
unlimited
Published
2025-03-28
Title
Unlimited < 1.46 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
unseen-blog
Published
2024-09-30
Title
Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection
Slug
upfrontwp
Published
2023-01-23
Title
Upfrontwp <= 1.1 - Reflected XSS
Slug
upscale
Published
2014-08-01
Title
Upscale - Unspecified XSS
Slug
upstore
Published
2025-08-02
Title
UpStore < 1.7.1 - Reflected Cross-Site Scripting
Slug
urbancity
Published
2014-09-20
Title
Urban City - download.php Local File Inclusion (LFI)
Slug
urna
Published
2025-08-06
Title
Urna < 2.5.8 - Unauthenticated Local File Inclusion