WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
u-design
Published
2015-05-20
Title
uDesign Theme 1.8.0-2.7.9 - DOM Cross-Site Scripting (XSS)
Slug
u-design
Published
2024-04-23
Title
UDesign < 4.13.6 - Reflected Cross-Site Scripting
Slug
u-design
Published
2026-02-26
Title
uDesign - Responsive WordPress Theme <= 4.14.0 - Reflected Cross-Site Scripting
Slug
udesign
Published
2025-01-24
Title
uDesign < 4.11.3 - Missing Authorization
Slug
ultimatum
Published
2015-02-11
Title
WordPress Slider Revolution - Local File Disclosure
Slug
ultimatum
Published
2014-11-30
Title
WordPress Slider Revolution Shell Upload
Slug
ultralight
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
ultrapress
Published
2024-09-30
Title
UltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection
Slug
umberto
Published
2025-05-21
Title
Umberto <= 1.2.8 - Unauthenticated PHP Object Injection
Slug
unakit
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
unakit
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
uncode
Published
2025-02-17
Title
Uncode < 2.9.1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description
Slug
uncode
Published
2025-02-17
Title
Uncode < 2.9.1.7 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed
Slug
uncode
Published
2025-02-17
Title
Uncode < 2.9.1.7 - Subscriber+ Arbitrary File Read in uncode_recordMedia
Slug
uncode
Published
2025-08-26
Title
Uncode < 2.9.4.4 - Reflected Cross-Site Scripting
Slug
uncode-lite
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
unica
Published
2026-03-06
Title
Unica - Event Planning & Wedding WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion
Slug
unicamp
Published
2025-08-14
Title
Unicamp < 2.6.4 - Unauthenticated Local File Inclusion
Slug
unicamp
Published
2026-02-04
Title
Unicamp < 2.7.2 - Authenticated (Contributor+) Local File Inclusion
Slug
unicon-lite
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
unique
Published
2024-04-30
Title
Unique <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
unitravel
Published
2025-08-23
Title
UniTravel <= 1.4.2 - Unauthenticated Local File Inclusion
Slug
unlimhost
Published
2026-02-17
Title
UnlimHost <= 1.2.3 - Unauthenticated Local File Inclusion
Slug
unlimited
Published
2025-03-28
Title
Unlimited < 1.46 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
unseen-blog
Published
2024-09-30
Title
Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection