The7 — Website and eCommerce Builder for WordPress

The7 — Website and eCommerce Builder for WordPress has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (78%). Other recurring categories include Cross-Site Request Forgery (CSRF), PHP Remote File Inclusion.

Every one of the 9 issues recorded for The7 — Website and eCommerce Builder for WordPress has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (3) reported by João Pedro Soares de Alcântara.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all The7 — Website and eCommerce Builder for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2025-63074

The7 < 12.8.1.1 - Authenticated (Contributor+) Local File Inclusion

Read the full analysis

Vulnerability Records

9 records


2026-05-14 00:00	The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter The7 <= 14.3.2	`CVE-2026-6646`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-10-24 00:00	The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css' The7 <= 12.9.1	`CVE-2025-11897`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-10-05 00:00	The7 < 12.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting The7 < 12.9.0	`CVE-2025-63073`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-10-04 00:00	The7 < 12.8.1.1 - Authenticated (Contributor+) Local File Inclusion The7 < 12.8.1.1	`CVE-2025-63074`	7.5 High	João Pedro Soares de Alcântara	Yes
2025-08-09 01:09	The7 <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes The7 <= 12.6.0	`CVE-2025-7726`	6.4 Medium	Webbernaut	Yes
2024-06-24 21:29	The7 — Website and eCommerce Builder for WordPress <= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute The7 <= 11.13.0	`CVE-2024-5451`	6.4 Medium	wesley (wcraft)	Yes
2023-06-28 00:00	The7 <= 11.7.3 - Cross-Site Request Forgery The7 <= 11.7.3	`CVE-2023-32123`	4.3 Medium	Dave Jong	Yes
2023-04-06 00:00	The7 <= 11.6.0 - Reflected Cross-Site Scripting The7 <= 11.6.0	`CVE-2023-29100`	6.1 Medium	Rafie Muhammad	Yes
2015-04-25 00:00	The7 — Website and eCommerce Builder for WordPress <= 2.1.0 - Reflected Cross-Site Scripting The7 <= 2.1.0	`N/A`	6.1 Medium	Anonymous	Yes

Showing 1–9 of 9 reports