designthemes vulnerabilities

Products

• LMS 4
• DesignThemes Core Features 3
• Reservation Plugin 2
• WeDesignTech Ultimate Booking Addon 2
• Crafts & Arts 1
• Dental Clinic 1
• DesignThemes Booking Manager 1
• DesignThemes Core 1
• DesignThemes Directory Addon 1
• DesignThemes LMS 1
• DesignThemes LMS Addon 1
• DesignThemes Portfolio 1
• DesignThemes Portfolio Addon 1
• DT LMS – elearning, WordPress LMS Plugin 1
• Finance Consultant 1
• Fitness Zone WordPress Theme 1
• HomeFix Elementor Portfolio 1
• Insurance 1
• Invico - WordPress Consulting Business Theme 1
• Kids Heaven 1
• Kids Life | Children School WordPress 1
• Knowledge Base 1
• Kriya 1
• LMS Elementor Pro 1
• Ofiz - WordPress Business Consulting Theme 1
• OneLife 1
• Pet World 1
• Red Art 1
• Single Property 1
• Solar Energy 1

Latest designthemes CVEs

Newest publication first · page 1 of 2

1. CVE-2026-78532 WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-10

   High·CVSS 7.1 EPSS 0.14%

   Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

2. CVE-2026-94061 WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-10-09

   High·CVSS 7.1 EPSS 0.15%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.

3. CVE-2026-11355 DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

   Published 2026-09-12

   Medium·CVSS 5.3 EPSS 0.43%

   The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up...

4. CVE-2026-27404 WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-07-02

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

5. CVE-2026-27402 WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-02

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

6. CVE-2025-69155 WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-02

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.

7. CVE-2025-69154 WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-02

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.

8. CVE-2025-69153 WordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-07-02

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.

9. CVE-2026-27983 WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability

   Published 2026-03-05

   Critical·CVSS 9.8 EPSS 0.37%

   Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.

10. CVE-2026-27390 WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

    Published 2026-03-05

    High·CVSS 8.8 EPSS 0.53%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

11. CVE-2026-27388 WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability

    Published 2026-03-05

    High·CVSS 7.5 EPSS 0.43%

    Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through <= 2.0.

12. CVE-2026-27389 WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

    Published 2026-03-05

    Critical·CVSS 9.8 EPSS 0.48%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

13. CVE-2026-27386 WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability

    Published 2026-03-05

    High·CVSS 7.5 EPSS 0.29%

    Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.

14. CVE-2026-27385 WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2026-03-05

    High·CVSS 7.1 EPSS 0.21%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.

15. CVE-2026-22473 WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability

    Published 2026-03-05

    High·CVSS 8.8 EPSS 0.44%

    Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.

16. CVE-2025-69302 WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2026-02-20

    High·CVSS 7.1 EPSS 0.22%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.

17. CVE-2025-69095 WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability

    Published 2026-01-22

    Medium·CVSS 6.5 EPSS 0.29%

    Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.

18. CVE-2025-69002 WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability

    Published 2026-01-22

    High·CVSS 8.8 EPSS 0.42%

    Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.

19. CVE-2025-68899 WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability

    Published 2026-01-22

    High·CVSS 8.8 EPSS 0.48%

    Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.

20. CVE-2025-67619 WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

    Published 2026-01-22

    High·CVSS 8.8 EPSS 0.74%

    Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.

21. CVE-2025-68982 WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

    Published 2025-12-30

    Medium·CVSS 5.3 EPSS 0.25%

    Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

22. CVE-2025-68981 WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

    Published 2025-12-30

    Medium·CVSS 5.3 EPSS 0.25%

    Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

23. CVE-2025-68977 WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Published 2025-12-30

    Medium·CVSS 6.5 EPSS 0.19%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.

24. CVE-2025-68978 WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Published 2025-12-30

    Medium·CVSS 6.5 EPSS 0.20%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.

25. CVE-2025-68980 WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability

    Published 2025-12-30

    Medium·CVSS 5.3 EPSS 0.25%

    Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.