WordPress Themes

Browse known vulnerabilities affecting WordPress Themes. Continuously updated with verified security disclosures, including severity, impact, and affected versions.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Filters

None active

Risk Level

Date Range (Last)

Vulnerability Records

2,734 records


2026-10-21 00:00	Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated Stored Cross-Site Scripting Hostme v2 - Responsive WordPress Theme <= 7.0	`CVE-2026-112849`	7.2 High	João Pedro S Alcântara	No
2026-10-21 00:00	Helion \| Personal Portfolio & Agency WordPress Theme <= 1.1.12 - Unauthenticated PHP Object Injection Helion <= 1.1.12	`CVE-2026-112852`	8.1 High	João Pedro S Alcântara	No
2026-10-21 00:00	HotLock \| Locksmith & Security Systems WordPress Theme + RTL <= 1.3.9 - Unauthenticated PHP Object Injection HotLock <= 1.3.9	`CVE-2026-112851`	8.1 High	João Pedro S Alcântara	No
2026-10-21 00:00	Vagabonds - Travel Blog Elementor Template Kit <= 1.3.10 - Unauthenticated PHP Object Injection Vagabonds - Travel Blog Elementor… <= 1.3.10	`CVE-2026-112856`	8.1 High	João Pedro S Alcântara	No
2026-10-21 00:00	Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated PHP Object Injection Hostme v2 - Responsive WordPress Theme <= 7.0	`CVE-2026-112848`	8.1 High	João Pedro S Alcântara	No
2026-10-21 00:00	KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting kallyas <= 4.25.0	`CVE-2026-112863`	7.2 High	Rafie Muhammad	No
2026-10-21 00:00	Save Life \| Non-Profit, Charity & Donations WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection Save Life <= 1.2.14	`CVE-2026-112846`	8.1 High	johska	No
2026-10-21 00:00	Little Birdies \| Multipurpose Children PSD Template <= 1.3.16 - Unauthenticated PHP Object Injection Little Birdies <= 1.3.16	`CVE-2026-112859`	8.1 High	João Pedro S Alcântara	No
2026-10-21 00:00	Redy <= 1.3.5 - Unauthenticated PHP Object Injection redy <= 1.3.5	`CVE-2026-112855`	8.1 High	João Pedro S Alcântara	No
2026-10-21 00:00	Reprizo - Jewelry & Watch Store Shopify Theme <= 1.0.8 - Unauthenticated PHP Object Injection Reprizo - Jewelry & Watch Store… <= 1.0.8	`CVE-2026-112857`	8.1 High	João Pedro S Alcântara	No

Showing 1–10 of 2,734 reports

All WordPress Themes

Every themes with a recorded vulnerability: 1,822 in total.Page 1 of 10.