The7 — Website and eCommerce Builder for WordPress

The7 — Website and eCommerce Builder for WordPress has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; 9 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (70%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

9 of the records (90%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

7 independent researchers contributed these findings, most of them (3) reported by João Pedro Soares de Alcântara.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage90%

Open

Fixed

Get automatic notifications for all The7 — Website and eCommerce Builder for WordPress vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-66588

The7 — Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization

Read the full analysis

Vulnerability Records

10 records


2026-10-05 16:25	The7 — Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization The7 <= 14.2.2	`CVE-2026-66588`	5.3 Medium	Bonds	No
2026-05-14 00:00	The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter The7 <= 14.3.2	`CVE-2026-6646`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-10-24 00:00	The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css' The7 <= 12.9.1	`CVE-2025-11897`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-10-05 00:00	The7 < 12.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting The7 < 12.9.0	`CVE-2025-63073`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-10-04 00:00	The7 < 12.8.1.1 - Authenticated (Contributor+) Local File Inclusion The7 < 12.8.1.1	`CVE-2025-63074`	7.5 High	João Pedro Soares de Alcântara	Yes
2025-08-09 01:09	The7 <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes The7 <= 12.6.0	`CVE-2025-7726`	6.4 Medium	Webbernaut	Yes
2024-06-24 21:29	The7 — Website and eCommerce Builder for WordPress <= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute The7 <= 11.13.0	`CVE-2024-5451`	6.4 Medium	wesley (wcraft)	Yes
2023-06-28 00:00	The7 <= 11.7.3 - Cross-Site Request Forgery The7 <= 11.7.3	`CVE-2023-32123`	4.3 Medium	Dave Jong	Yes
2023-04-06 00:00	The7 <= 11.6.0 - Reflected Cross-Site Scripting The7 <= 11.6.0	`CVE-2023-29100`	6.1 Medium	Rafie Muhammad	Yes
2015-04-25 00:00	The7 — Website and eCommerce Builder for WordPress <= 2.1.0 - Reflected Cross-Site Scripting The7 <= 2.1.0	`N/A`	6.1 Medium	Anonymous	Yes

Showing 1–10 of 10 reports