Consulting

Consulting has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. Consulting is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium
7.0/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all Consulting vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-63032

Consulting <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Consulting screenshot
Latestv1.6.2
3.0(19)
60/100
Last Updated
2026-05-08 (4mo ago)
Active Installs
10,000+
Downloads
439,684
Requires WP
5.0+
Requires PHP
7.0+
Created
2017-05-31 (9y ago)

Consulting is the free version of the multi-purpose professional theme (Consulting Pro) ideal for a business or blog website. The theme has a responsive layout, HD retina ready and comes with a powerful theme options panel with can be used to make awesome changes without touching any code. The theme also comes with a full width easy to use slider. Easily add a logo to your site and create a beautiful homepage using the built-in homepage layout.

Tags
BlogE commerceOne columnCustom menuGrid layoutPhotographySticky postTwo columnsLeft sidebarPost formatsCustom headerRight sidebarTheme optionsThree columnsFooter widgetsFeatured imagesFlexible headerCustom backgroundThreaded commentsTranslation readyFull width template

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C