WordPress Theme Vulnerabilities

Slug
Published
Title
Slug
valen
Published
2025-06-09
Title
Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
Slug
veda
Published
2025-03-04
Title
VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
Slug
veda
Published
2025-06-24
Title
VEDA <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
Slug
velvet
Published
2014-08-01
Title
Velvet - Unspecified XSS
Slug
venice-lite
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
verbosa
Published
2024-09-16
Title
Verbosa < 1.2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
vernissage
Published
2015-06-26
Title
Multiple Themes - Privilige Escalation
Slug
vertice
Published
2024-04-26
Title
ColibriWP Theme framework - Various Versions and Themes - Missing Authorization
Slug
viable-blog
Published
2023-04-25
Title
Viable blog <= 1.1.4 - Reflected XSS
Slug
viala
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
viala
Published
2024-09-24
Title
Viala <= 1.3.1 - Reflected Cross-Site Scripting
Slug
viburno
Published
2023-08-14
Title
Multiple Themes - Reflected XSS
Slug
videoblog
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
vidmov
Published
2025-07-23
Title
VidMov <= 1.9.4 - Unauthenticated Local File Inclusion
Slug
vikinger
Published
2025-04-24
Title
Vikinger < 1.9.31 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'
Slug
vikinger
Published
2025-07-01
Title
Vikinger < 1.9.33 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger_delete_activity_media_ajax Function
Slug
villar
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
villar
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
vilva
Published
2024-06-20
Title
Vilva < 1.2.3 - Cross-Site Request Forgery to Notice Dismissal
Slug
viralike
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
viralike
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
virtue
Published
2024-04-25
Title
Virtue < 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
Slug
visual-arts
Published
2025-07-15
Title
Visual Art | Gallery WordPress Theme <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
Slug
visual-composer-starter
Published
2024-08-12
Title
Visual Composer Starter < 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
vithy
Published
2014-08-01
Title
vithy - Full Path Disclosure