Vulnerabilities

Filters

1 selected

47 records

Sort

Vendor: designthemes Clear all filters

TI-2026-70439 CVE-2026-78532 · GHSA-29c3-gqwg-r9fm

WordPress LMS theme vulnerable to unauthenticated XSS

LOW 30

Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-10-10 No fix listed CWE-79

TI-2026-70010 CVE-2026-94061 · GHSA-3cgc-37qf-jpgp

Reflected cross-site scripting in WordPress Whistle - Sports Club theme

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club:…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00146 Published 2026-10-09 No fix listed CWE-79

TI-2026-09801 CVE-2026-11355 · GHSA-xcq8-9qm4-gwm6

Missing authorization in designthemes DT LMS – elearning, WordPress LMS Plugin

LOW 30

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_ski…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00425 Published 2026-09-12 No fix listed CWE-862

TI-2026-21818 CVE-2026-27404 · GHSA-mmf8-rfrr-cx8x

WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2026-21816 CVE-2026-27402 · GHSA-7rxg-r73h-jq37

WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2025-42610 CVE-2025-69156 · GHSA-fwm5-jmc4-xhcx

WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2025-42609 CVE-2025-69155 · GHSA-8mp7-55hp-m92p

WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2025-42608 CVE-2025-69154 · GHSA-wr8f-c78x-3pvx

WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2025-42607 CVE-2025-69153 · GHSA-6cxj-rvj8-j8p8

WordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2026-22325 CVE-2026-27983 · GHSA-vwhg-vhp3-3mp5

WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability

MEDIUM 43

Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00373 Published 2026-03-05 No fix listed CWE-266

TI-2026-21806 CVE-2026-27390 · GHSA-fmgj-x956-32c7

WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

MEDIUM 41

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech U…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00533 Published 2026-03-05 No fix listed CWE-288

TI-2026-21805 CVE-2026-27389 · GHSA-p5mj-rxf6-hc9h

WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

MEDIUM 49

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech U…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-03-05 No fix listed CWE-288

TI-2026-21804 CVE-2026-27388 · GHSA-95pw-wcgr-8xpg

WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Bookin…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00428 Published 2026-03-05 No fix listed CWE-862

TI-2026-21802 CVE-2026-27386 · GHSA-3wj9-ggg9-3g9j

WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Direct…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00285 Published 2026-03-05 No fix listed CWE-862

TI-2026-21801 CVE-2026-27385 · GHSA-qwrq-9h7w-r9fx

WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfo…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00214 Published 2026-03-05 No fix listed CWE-79

TI-2026-18054 CVE-2026-22473 · GHSA-5f53-5f35-m7wq

WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability

MEDIUM 40

Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00437 Published 2026-03-05 No fix listed CWE-502

TI-2025-42745 CVE-2025-69302 · GHSA-xg7c-7v8p-8ww8

WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignTheme…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00221 Published 2026-02-20 No fix listed CWE-79

TI-2025-42549 CVE-2025-69095 · GHSA-gcxg-h2w4-gx96

WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability

LOW 35

Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00287 Published 2026-01-22 No fix listed CWE-862

TI-2025-42457 CVE-2025-69002 · GHSA-x5x7-57r8-grmr

WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability

MEDIUM 40

Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00418 Published 2026-01-22 No fix listed CWE-502

TI-2025-42357 CVE-2025-68899 · GHSA-f46g-p4wx-ggmf

WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability

MEDIUM 41

Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00483 Published 2026-01-22 No fix listed CWE-502

TI-2025-41362 CVE-2025-67619 · GHSA-74pm-9rv5-w35v

WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

LOW 39

Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00737 Published 2026-01-22 No fix listed CWE-502

TI-2025-42438 CVE-2025-68982 · GHSA-qw33-f2vh-j266

WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2025-12-30 No fix listed CWE-862

TI-2025-42437 CVE-2025-68981 · GHSA-r6vr-4858-x6vp

WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2025-12-30 No fix listed CWE-862

TI-2025-42436 CVE-2025-68980 · GHSA-v4xq-5vm7-92m6

WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2025-12-30 No fix listed CWE-862

TI-2025-42434 CVE-2025-68978 · GHSA-mhjc-2v6r-pmrm

WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a t…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00202 Published 2025-12-30 No fix listed CWE-79