Blog Designer PRO for WordPress

Blog Designer PRO for WordPress has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is PHP Remote File Inclusion, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

None of the 4 issues recorded for Blog Designer PRO for WordPress have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, most of them (3) reported by Bonds.

01234567891021.05.2025Today21.05.20259.8Blog Designer PRO for WordPress <= 3.4.7 - Unauthenticated Local File Inclusion CVSS 9.8 · 21.05.202530.05.20256.1Blog Designer PRO for WordPress <= 3.4.7 - Reflected Cross-Site Scripting CVSS 6.1 · 30.05.202513.08.20257.5Blog Designer PRO <= 3.4.7 - Authenticated (Subscriber+) Local File Inclusion CVSS 7.5 · 13.08.202529.08.20255.3Blog Designer PRO <= 3.4.8 - Missing Authorization CVSS 5.3 · 29.08.2025

Strategic Overview

Avg CVSSHigh
7.2/ 10
Patch Coverage0%
Open

4

Fixed

0

Get automatic notifications for all Blog Designer PRO for WordPress vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2025-47696

Blog Designer PRO for WordPress <= 3.4.7 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

4 records
Showing 1–4 of 4 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C