WordPress Themes

Browse known vulnerabilities affecting WordPress Themes. Continuously updated with verified security disclosures, including severity, impact, and affected versions.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Filters

None active

Risk Level

Date Range (Last)

Vulnerability Records

2,571 records


2026-09-04 18:15	Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3853`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-04 18:13	Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter Divi <= 4.27.6	`CVE-2026-4361`	5.0 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-04 00:00	WP Rentals - Booking Accommodation WordPress Theme < 3.16.0 - Authenticated (Subscriber+) Insecure Direct Object Reference WP Rentals - Booking Accommodation… < 3.16.0	`CVE-2026-27432`	4.3 Medium	Rafie Muhammad	Yes
2026-09-04 00:00	Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover Nokri <= 1.6.4	`CVE-2025-9049`	8.8 High	Tonn	Yes
2026-09-04 00:00	Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Woodmart < 8.3.8	`CVE-2026-27086`	6.4 Medium	João Pedro S Alcântara	Yes
2026-09-03 00:00	Enfold - Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting enfold <= 8.0	`CVE-2026-84815`	7.2 High	Rafie Muhammad	Yes
2026-09-02 19:51	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter Divi <= 4.27.6	`CVE-2026-3852`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes
2026-09-02 00:00	Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting Graphene <= 2.9.4	`CVE-2026-81281`	6.4 Medium	HieuPenguinnn	Yes
2026-09-02 00:00	Grand Tour \| Travel Agency WordPress <= 5.5.1 - Cross-Site Request Forgery Grand Tour <= 5.5.1	`CVE-2026-66652`	4.3 Medium	Tran Nguyen Bao Khanh	No
2026-09-01 17:38	Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter Divi <= 4.27.5	`CVE-2026-3850`	6.4 Medium	Osvaldo Noe Gonzalez Del Rio (Os)	Yes

Showing 1–10 of 2,571 reports

All WordPress Themes

Every themes with a recorded vulnerability: 1,758 in total.Page 1 of 9.